use-link-identity
Present Link Attestations and Identity Claims
Services can require agent attestations or signed identity claims before accepting a request. This skill guides Link CLI workflows for obtaining proofs and presenting authorized claims.
Установить с помощью моего Агента
Скопируйте этот запрос в своего Агента. Он содержит каноническую страницу Skill и манифест.
Review the Skillstore skill "use-link-identity" from https://skillstore.io/skills/stripe-use-link-identity.md and its manifest at https://skillstore.io/api/skills/stripe-use-link-identity/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.Ваш Агент по-прежнему должен показать план и запросить все подтверждения, требуемые политикой безопасности.
Ресурсы для AI-агентов
Используйте эти ссылки, когда AI-агенту, crawler или script нужен чистый контекст вместо полной страницы.
Протестировать
Использование «use-link-identity». Explain how to respond when the attestation pool is empty.
Ожидаемый результат:
- Request a new batch before attempting to pop a token.
- Use the returned authorization value unchanged for the intended endpoint.
- Keep token values out of transcripts and logs.
Использование «use-link-identity». Explain the checks before presenting my email claim.
Ожидаемый результат:
- Confirm that a usable credential includes the email claim.
- Validate the intended service audience and current nonce.
- Select only the authorized email claim and keep the credential and holder key local.
- Report success only after the service accepts the request.
Аудит безопасности
БезопасноAll 40 static findings are false positives in this documentation-only skill. Markdown formatting, expected identity storage, example URLs, and explicit secret-protection guidance explain the detections. No evidence found of prompt injection, unauthorized disclosure, or malicious execution in the reviewed file.
Факторы риска
⚙️ Внешние команды (28)
🌐 Доступ к сети (4)
📁 Доступ к файловой системе (6)
Поделиться и цитировать этот отчет
Делитесь версионным отчетом об оценке, нейтральным значком, встраиваемой карточкой и цитатами. Skillstore публикует доказательства, не решая, безопасен ли этот Skill.
Копировать ссылку на отчёт
https://skillstore.io/skills/stripe-use-link-identity/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportЗначок Markdown
[](https://skillstore.io/skills/stripe-use-link-identity?utm_source=security_passport_badge)Значок HTML
<a href="https://skillstore.io/skills/stripe-use-link-identity?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/stripe-use-link-identity/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Встраиваемая карточка
<iframe src="https://skillstore.io/embed/skills/stripe-use-link-identity.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Академические ссылки (APA · BibTeX · CFF)
Цитата APA
stripe. (2026). use-link-identity security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/stripe-use-link-identity/audits/1Цитата BibTeX
@techreport{stripe-stripe-use-link-identity-2026,
author = {stripe},
title = {use-link-identity security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/stripe-use-link-identity/audits/1},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "use-link-identity security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
- name: "stripe"
date-released: "2026-10-17"
url: "https://skillstore.io/skills/stripe-use-link-identity/audits/1"
identifiers:
- type: other
value: "skillstore:stripe-use-link-identity:audit:1"
description: "Skillstore immutable audit report identifier"
Оценка Skillstore
Почему такая оценка Достоверность доказательств: СреднийЧто вы можете построить
Respond to an attestation challenge
Inspect the local pool, obtain an AAT when needed, and pass its authorization value to the intended endpoint.
Present an authorized email claim
Use a verified audience and nonce to present only the email claim requested by the service and authorized by the user.
Coordinate attestation allocation
Export an attestation batch and plan token ownership, concurrency, and cleanup outside the internal CLI pool.
Попробуйте эти промпты
Check Link CLI version and local identity inventory. Report availability and errors without exposing tokens, private keys, or claim values.
Handle the PrivateToken challenge for [endpoint]. Check inventory and refill only if needed. Send the exact authorization value without logging it.
Present only my authorized email claim to [endpoint]. Validate its audience and nonce, use safe process arguments, and report only the acceptance status.
Plan an exported AAT batch for [worker count] workers. Address permissions, allocation, concurrency, cleanup, identity isolation, and retries. Do not request tokens yet.
Лучшие практики
- Parse CLI JSON programmatically and keep proofs, private keys, and claim values out of transcripts and logs.
- Validate the destination, audience, and nonce before presenting only claims authorized by the user.
- Use separate home directories for different users and restrictive permissions for proof handoff files.
Избегать
- Manually reconstructing tokens or presentations, or including them in logs.
- Using global browser headers or forwarding identity proofs across origins.
- Assuming an authentication change switches cached identity, or disclosing raw credentials instead of selected claims.
Часто задаваемые вопросы
What is the difference between an AAT and a presentation?
Which Link CLI version is required?
Can I use these commands through Link MCP tools?
Which operations require Link authentication?
Does logging in as another user switch cached identity?
Can I reuse attestations and presentations?
Сведения для разработчиков
Автор
stripeЛицензия
Complete terms at https://github.com/stripe/link-cli/blob/main/LICENSE
Ревизия Skillstore
r1
Примечание о версии
Автор не указал версию.
Репозиторий
https://github.com/stripe/link-cli/tree/f68a825866c67ecc759c42115b73a12176401e3d/skills/use-link-identityСсылка
8b0f5f59e50ec6f1de06321c2ecc77427561d561
Актуальность поддержки
17.10.2026
Использование
0 загрузок · 0 просмотров
Структура файлов
📄 SKILL.md