wendy-security-baselines — Claude Code skill: what it does and setup
Security review rules for Wendy interop PRs: blocks bearer secrets, protects platform policy caps, and enforces proof-of-possession.
npx skills add wendylabsinc/claude-skills --skill wendy-security-baselines -a claude-codeWhat wendy-security-baselines does
This skill provides a review checklist of invariants derived from the AAA contract v0.21. It inspects changes across pki-core, wendy-auth, cloud services, wendy-proxy, and wendy-agent. Under these rules, conventional bearer secrets and raw API tokens are prohibited on the wire in favor of sender-constrained tokens signed with ML-DSA-65.
SaaS-exclusive features are explicitly treated as incomplete defects. Every interop pull request must keep the self-hosted stack fully functional without relying on cloud infrastructure.
The policy ceiling lives solely inside pki-core config, meaning no cloud path can alter platform boundaries. In addition, SSF and CAEP streams function only as fail-safe channels: they downgrade, revoke, or terminate sessions, but never push authority increases.
What it helps with
- audit interop code against AAA contract invariants during review
- prevent unconstrained bearer tokens from reaching production
- enforce dual-path self-hosted operation on every new interop feature
- verify tamper-evident audit logging and correlation tracking across services
Example prompts for the agent
- Review my interop pull request against wendy security baselines.
- Check our new credential issuance logic for bearer token violations.
- Audit the proxy changes to ensure platform cap boundaries remain intact.
How to install wendy-security-baselines
1Skills CLI (Vercel)
npx skills add wendylabsinc/claude-skills --skill wendy-security-baselines -a claude-code2Manually: put the files in place
~/.claude/skills/wendy-security-baselines/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/wendy-security-baselines/
1Skills CLI (Vercel)
npx skills add wendylabsinc/claude-skills --skill wendy-security-baselines -a codex2Manually: put the files in place
.agents/skills/wendy-security-baselines/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add wendylabsinc/claude-skills --skill wendy-security-baselines -a cursor2Manually: put the files in place
.cursor/skills/wendy-security-baselines/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install wendylabsinc/claude-skills wendy-security-baselines2Manually: put the files in place
.github/skills/wendy-security-baselines/SKILL.md1Skills CLI (Vercel)
npx skills add wendylabsinc/claude-skills --skill wendy-security-baselines -a gemini-cli2Platform CLI
gemini skills install https://github.com/wendylabsinc/claude-skills --path wendy-security-baselinesManually: put the files in place
.devin/skills/wendy-security-baselines/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add wendylabsinc/claude-skills --skill wendy-security-baselines -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about wendy-security-baselines
How to install wendy-security-baselines in Claude Code?
Run npx skills add wendylabsinc/claude-skills --skill wendy-security-baselines -a claude-code in your terminal.
What is wendy-security-baselines?
It is a review checklist skill verifying auth, key custody, audit trails, and interop invariants across Wendy components.
Which signing algorithm does this baseline require?
It mandates per-request proof-of-possession signing using ML-DSA under RFC 9964, defaulting to ML-DSA-65 leaves.
