スキル use-link-identity
📦
use-link-identity
コンテンツリビジョン r1 安全 ⚙️ 外部コマンド🌐 ネットワークアクセス📁 ファイルシステムへのアクセス
Present Link Attestations and Identity Claims
Services can require agent attestations or signed identity claims before accepting a request. This skill guides Link CLI workflows for obtaining proofs and presenting authorized claims.
対応: Claude Codex Code(CC)
自分のエージェントでインストール
このリクエストをエージェントにコピーしてください。正規の Skill ページとマニフェストが含まれています。
エージェントリクエスト
Review the Skillstore skill "use-link-identity" from https://skillstore.io/skills/stripe-use-link-identity.md and its manifest at https://skillstore.io/api/skills/stripe-use-link-identity/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.エージェントは引き続き計画を提示し、セキュリティポリシーで必要な確認を求める必要があります。
エージェントが読めるリソース
AI エージェント、クローラー、スクリプトがページ全体ではなく整理されたコンテキストを必要とする場合は、これらのリンクを使ってください。
テストする
「use-link-identity」を使用しています。 Explain how to respond when the attestation pool is empty.
期待される結果:
- Request a new batch before attempting to pop a token.
- Use the returned authorization value unchanged for the intended endpoint.
- Keep token values out of transcripts and logs.
「use-link-identity」を使用しています。 Explain the checks before presenting my email claim.
期待される結果:
- Confirm that a usable credential includes the email claim.
- Validate the intended service audience and current nonce.
- Select only the authorized email claim and keep the credential and holder key local.
- Report success only after the service accepts the request.
セキュリティ監査
安全v1 • 2026/10/17 バージョン別レポートを開く
All 40 static findings are false positives in this documentation-only skill. Markdown formatting, expected identity storage, example URLs, and explicit secret-protection guidance explain the detections. No evidence found of prompt injection, unauthorized disclosure, or malicious execution in the reviewed file.
1
スキャンされたファイル
109
解析済み行数
0
レビュー項目
0
誤検知を無視
リスク要因
⚙️ 外部コマンド (28)
SKILL.md:16 SKILL.md:20 SKILL.md:21 SKILL.md:27 SKILL.md:30 SKILL.md:31 SKILL.md:32 SKILL.md:36-45 SKILL.md:45-47 SKILL.md:47 SKILL.md:49-51 SKILL.md:51-58 SKILL.md:58-60 SKILL.md:60 SKILL.md:64-66 SKILL.md:66-68 SKILL.md:68 SKILL.md:72-78 SKILL.md:78-80 SKILL.md:80 SKILL.md:82-88 SKILL.md:88-90 SKILL.md:90-94 SKILL.md:94-96 SKILL.md:96-98 SKILL.md:98-104 SKILL.md:104-105 SKILL.md:105-106
🌐 ネットワークアクセス (4)
📁 ファイルシステムへのアクセス (6)
最新の完了済み静的・セマンティック監査では、確認済みのセキュリティ検出事項は見つかりませんでした。これは、スキルに副作用がないことを証明するものではありません。
監査者: codex
このレポートを共有・引用
バージョン付き評価レポート、中立的なバッジ、埋め込みカード、引用を共有できます。Skillstore は証拠を報告しますが、この Skill が安全かどうかは判断しません。
レポートリンクをコピー
https://skillstore.io/skills/stripe-use-link-identity/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdownバッジ
[](https://skillstore.io/skills/stripe-use-link-identity?utm_source=security_passport_badge)HTMLバッジ
<a href="https://skillstore.io/skills/stripe-use-link-identity?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/stripe-use-link-identity/security.svg" alt="Skillstore security assessment" loading="lazy"></a>埋め込みカード
<iframe src="https://skillstore.io/embed/skills/stripe-use-link-identity.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学術引用 (APA · BibTeX · CFF)
APA形式の引用
stripe. (2026). use-link-identity security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/stripe-use-link-identity/audits/1BibTeX形式の引用
@techreport{stripe-stripe-use-link-identity-2026,
author = {stripe},
title = {use-link-identity security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/stripe-use-link-identity/audits/1},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "use-link-identity security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
- name: "stripe"
date-released: "2026-10-17"
url: "https://skillstore.io/skills/stripe-use-link-identity/audits/1"
identifiers:
- type: other
value: "skillstore:stripe-use-link-identity:audit:1"
description: "Skillstore immutable audit report identifier"
Skillstore スコア
このスコアの理由 証拠の信頼度: 中 55
アーキテクチャ
85
保守性
87
コンテンツ
65
コミュニティ
91
仕様準拠
作成できるもの
Respond to an attestation challenge
Inspect the local pool, obtain an AAT when needed, and pass its authorization value to the intended endpoint.
Present an authorized email claim
Use a verified audience and nonce to present only the email claim requested by the service and authorized by the user.
Coordinate attestation allocation
Export an attestation batch and plan token ownership, concurrency, and cleanup outside the internal CLI pool.
これらのプロンプトを試す
Inspect identity readiness
Check Link CLI version and local identity inventory. Report availability and errors without exposing tokens, private keys, or claim values.
Handle an attestation request
Handle the PrivateToken challenge for [endpoint]. Check inventory and refill only if needed. Send the exact authorization value without logging it.
Present selected claims
Present only my authorized email claim to [endpoint]. Validate its audience and nonce, use safe process arguments, and report only the acceptance status.
Plan multi-agent token handling
Plan an exported AAT batch for [worker count] workers. Address permissions, allocation, concurrency, cleanup, identity isolation, and retries. Do not request tokens yet.
ベストプラクティス
- Parse CLI JSON programmatically and keep proofs, private keys, and claim values out of transcripts and logs.
- Validate the destination, audience, and nonce before presenting only claims authorized by the user.
- Use separate home directories for different users and restrictive permissions for proof handoff files.
回避
- Manually reconstructing tokens or presentations, or including them in logs.
- Using global browser headers or forwarding identity proofs across origins.
- Assuming an authentication change switches cached identity, or disclosing raw credentials instead of selected claims.
よくある質問
What is the difference between an AAT and a presentation?
An AAT proves Link issuance without user claims. A presentation discloses selected claims and proves holder-key possession for an audience and nonce.
Which Link CLI version is required?
Use Link Agent Wallet v0.27.0 or later. Identity commands are in beta and do not require a preview flag.
Can I use these commands through Link MCP tools?
No. The documented identity commands are available through the CLI, not its MCP tools.
Which operations require Link authentication?
Only request operations require Link authentication. List, pop, and present use local files.
Does logging in as another user switch cached identity?
No. Cached identity belongs to the home directory. Use separate home directories for different users.
Can I reuse attestations and presentations?
Keep an AAT for retries within an existing interaction, subject to service rules. Use fresh challenges after nonce consumption or expiry.