技能 use-link-identity
📦
use-link-identity
內容修訂 r1 安全 ⚙️ 外部命令🌐 網路存取📁 檔案系統存取
Present Link Attestations and Identity Claims
Services can require agent attestations or signed identity claims before accepting a request. This skill guides Link CLI workflows for obtaining proofs and presenting authorized claims.
支援: Claude Codex Code(CC)
使用我的智慧代理安裝
將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。
智能體請求
Review the Skillstore skill "use-link-identity" from https://skillstore.io/skills/stripe-use-link-identity.md and its manifest at https://skillstore.io/api/skills/stripe-use-link-identity/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。
Agent 可讀資源
當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。
測試它
正在使用「use-link-identity」。 Explain how to respond when the attestation pool is empty.
預期結果:
- Request a new batch before attempting to pop a token.
- Use the returned authorization value unchanged for the intended endpoint.
- Keep token values out of transcripts and logs.
正在使用「use-link-identity」。 Explain the checks before presenting my email claim.
預期結果:
- Confirm that a usable credential includes the email claim.
- Validate the intended service audience and current nonce.
- Select only the authorized email claim and keep the credential and holder key local.
- Report success only after the service accepts the request.
安全審計
安全v1 • 2026/10/17 開啟版本化報告
All 40 static findings are false positives in this documentation-only skill. Markdown formatting, expected identity storage, example URLs, and explicit secret-protection guidance explain the detections. No evidence found of prompt injection, unauthorized disclosure, or malicious execution in the reviewed file.
1
已掃描檔案
109
分析行數
0
複核項目
0
已忽略的誤報
風險因素
⚙️ 外部命令 (28)
SKILL.md:16 SKILL.md:20 SKILL.md:21 SKILL.md:27 SKILL.md:30 SKILL.md:31 SKILL.md:32 SKILL.md:36-45 SKILL.md:45-47 SKILL.md:47 SKILL.md:49-51 SKILL.md:51-58 SKILL.md:58-60 SKILL.md:60 SKILL.md:64-66 SKILL.md:66-68 SKILL.md:68 SKILL.md:72-78 SKILL.md:78-80 SKILL.md:80 SKILL.md:82-88 SKILL.md:88-90 SKILL.md:90-94 SKILL.md:94-96 SKILL.md:96-98 SKILL.md:98-104 SKILL.md:104-105 SKILL.md:105-106
🌐 網路存取 (4)
📁 檔案系統存取 (6)
最近一次完成的靜態與語意稽核未偵測到已確認的安全發現。這並不能證明該 Skill 沒有副作用。
審計單位: codex
分享與引用此報告
分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。
複製報告連結
https://skillstore.io/skills/stripe-use-link-identity/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/stripe-use-link-identity?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/stripe-use-link-identity?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/stripe-use-link-identity/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/stripe-use-link-identity.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>學術引用 (APA · BibTeX · CFF)
APA 引用
stripe. (2026). use-link-identity security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/stripe-use-link-identity/audits/1BibTeX 引用
@techreport{stripe-stripe-use-link-identity-2026,
author = {stripe},
title = {use-link-identity security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/stripe-use-link-identity/audits/1},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "use-link-identity security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
- name: "stripe"
date-released: "2026-10-17"
url: "https://skillstore.io/skills/stripe-use-link-identity/audits/1"
identifiers:
- type: other
value: "skillstore:stripe-use-link-identity:audit:1"
description: "Skillstore immutable audit report identifier"
Skillstore 評分
評分依據 證據置信度: 中 55
架構
85
可維護性
87
內容
65
社群
91
規範符合度
你可以打造什麼
Respond to an attestation challenge
Inspect the local pool, obtain an AAT when needed, and pass its authorization value to the intended endpoint.
Present an authorized email claim
Use a verified audience and nonce to present only the email claim requested by the service and authorized by the user.
Coordinate attestation allocation
Export an attestation batch and plan token ownership, concurrency, and cleanup outside the internal CLI pool.
試試這些提示
Inspect identity readiness
Check Link CLI version and local identity inventory. Report availability and errors without exposing tokens, private keys, or claim values.
Handle an attestation request
Handle the PrivateToken challenge for [endpoint]. Check inventory and refill only if needed. Send the exact authorization value without logging it.
Present selected claims
Present only my authorized email claim to [endpoint]. Validate its audience and nonce, use safe process arguments, and report only the acceptance status.
Plan multi-agent token handling
Plan an exported AAT batch for [worker count] workers. Address permissions, allocation, concurrency, cleanup, identity isolation, and retries. Do not request tokens yet.
最佳實務
- Parse CLI JSON programmatically and keep proofs, private keys, and claim values out of transcripts and logs.
- Validate the destination, audience, and nonce before presenting only claims authorized by the user.
- Use separate home directories for different users and restrictive permissions for proof handoff files.
避免
- Manually reconstructing tokens or presentations, or including them in logs.
- Using global browser headers or forwarding identity proofs across origins.
- Assuming an authentication change switches cached identity, or disclosing raw credentials instead of selected claims.
常見問題
What is the difference between an AAT and a presentation?
An AAT proves Link issuance without user claims. A presentation discloses selected claims and proves holder-key possession for an audience and nonce.
Which Link CLI version is required?
Use Link Agent Wallet v0.27.0 or later. Identity commands are in beta and do not require a preview flag.
Can I use these commands through Link MCP tools?
No. The documented identity commands are available through the CLI, not its MCP tools.
Which operations require Link authentication?
Only request operations require Link authentication. List, pop, and present use local files.
Does logging in as another user switch cached identity?
No. Cached identity belongs to the home directory. Use separate home directories for different users.
Can I reuse attestations and presentations?
Keep an AAT for retries within an existing interaction, subject to service rules. Use fresh challenges after nonce consumption or expiry.