The Agent Skills Directory

External Dependency Usage: The skill utilizes the @stripe/link-cli package, fetched via standard Node.js package managers. This is the official tool provided by the vendor for the skill's core functionality.
Identity File Management: The skill interacts with sensitive local identity files and private keys (e.g., ~/.link-cli/identity/holder-key.jwk). This is a necessary component of the skill's identity management purpose. The documentation includes important guidance for protecting these files, such as using separate home directories for different users and ensuring credentials are not included in logs.
External Data Interaction (Indirect Prompt Injection): The skill processes 'audience' and 'nonce' values provided by external services during the credential presentation flow. While this represents a potential data ingestion surface, the skill includes mitigations such as safe shell quoting and argument handling.
Ingestion points: Service challenge parameters (audience and nonce) described in the credentials present section of SKILL.md.
Boundary markers: The skill explicitly advises using individual process arguments or safe shell quoting to prevent command misinterpretation.
Capability inventory: Utilizes the link-cli tool via Bash for cryptographic signing and identity presentation.
Sanitization: Documentation provides instructions on safe interpolation and quoting for external inputs.

use-link-identity