Pilot Certificate

核心功能是为Pilot Protocol生成、发送、验证基于Ed25519签名的时效化能力证书，可指定权限范围与有效期；典型场景包括代理授权、权限校验；输入为JSON格式证书配置，输出为可验证的签名证书；需依赖pilotctl等工具，适合临时权限委派，不适用长期凭证或PKI体系。

teoslayer

热度 37.00

最近更新 2026-05-18 11:39:47

分类：安全依赖：代码执行 / 读写文件 / 第三方 API应用场景：自动化脚本 / 法律文档 / 工作流

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add pilot-certificate

Metadata

name: pilot-certificate
description: Issue and verify Ed25519-signed capability certificates for Pilot Protocol agents. Use this skill when: 1. You need to issue capability proofs or authorization certificates 2. You want to verify agent capabilities using cryptographic signatures 3. You need delegated authorization with time-limited certificates Do NOT use this skill when: - You only need basic trust establishment (use pilotctl trust) - You need long-term credentials (use pilot-keychain) - You're implementing PKI (certificates are capability-based, not identity-based)
tags: ["pilot-protocol","trust-security","certificates"]
license: AGPL-3.0
compatibility: Requires pilot-protocol skill and pilotctl binary on PATH. The daemon must be running (pilotctl daemon start).
metadata: {"author":"vulture-labs","version":"1.0","openclaw":{"requires":{"bins":["pilotctl"]},"homepage":"https://pilotprotocol.network"}}
allowed-tools: ["Bash"]

Pilot Certificate

Capability certificate system for Pilot Protocol using Ed25519 signatures.

Commands

Issue Certificate

CERT_ID=$(openssl rand -hex 8)
EXPIRES_AT=$(date -u -d '+24 hours' +%Y-%m-%dT%H:%M:%SZ)

cat > ~/.pilot/certificates/issued/cert-$CERT_ID.json <<EOF
{
  "certificate_id": "$CERT_ID",
  "subject": {"hostname": "$SUBJECT"},
  "capabilities": ["read", "write", "admin"],
  "expires_at": "$EXPIRES_AT",
  "status": "active"
}
EOF

Send Certificate

pilotctl --json send-file "$RECIPIENT" ~/.pilot/certificates/issued/cert-$CERT_ID.json

Verify Certificate

EXPIRES_AT=$(jq -r '.expires_at' "$CERT_FILE")
EXPIRES_TS=$(date -d "$EXPIRES_AT" +%s)

[ $(date +%s) -le $EXPIRES_TS ] && echo "VERIFIED" || echo "EXPIRED"

Check Capability

jq -e --arg cap "$CAPABILITY" '.capabilities[] | select(. == $cap)' "$CERT_FILE" && echo "Has capability"

Workflow Example

#!/bin/bash
# Certificate authority

mkdir -p ~/.pilot/certificates/{issued,received}

CERT_ID=$(openssl rand -hex 8)
SUBJECT="admin.pilot"

cat > ~/.pilot/certificates/issued/cert-$CERT_ID.json <<EOF
{
  "certificate_id": "$CERT_ID",
  "subject": {"hostname": "$SUBJECT"},
  "capabilities": ["read", "write", "admin"],
  "expires_at": "$(date -u -d '+48 hours' +%Y-%m-%dT%H:%M:%SZ)",
  "status": "active"
}
EOF

pilotctl --json send-file "$SUBJECT" ~/.pilot/certificates/issued/cert-$CERT_ID.json

Dependencies

Requires pilot-protocol, pilotctl, jq, and openssl.