lightning-security-module
Set up an lnd remote signer container that holds private keys separately from the agent. Exports a credentials bundle (accounts JSON, TLS cert, admin macaroon) for watch-only litd nodes. Container-first with Docker, native fallback. Use when firewalling private key material from AI agents.
Why use this skill?
Learn how to isolate your Lightning Network private keys from your AI agents using the lightning-security-module for remote signing and advanced wallet security.
Install via CLI (Recommended)
clawhub install openclaw/skills/skills/roasbeef/lightning-security-moduleWhat This Skill Does
The lightning-security-module is a mission-critical utility for users running Lightning Network nodes who need to decouple key management from their AI agent's active operations. By isolating private key material into a hardened, remote-signer container (or native instance), the skill ensures that even in a total compromise of the agent machine, the wallet seed remains offline and unreachable. The signer acts strictly as a cryptographic oracle, responsible only for signing commitments, channel state transitions, and on-chain transactions, while the agent-side 'watch-only' node manages the p2p networking, routing, and operational logic.
Installation
To install this module, execute the command: clawhub install openclaw/skills/skills/roasbeef/lightning-security-module. By default, this installs a Docker-based signer using the stable lightninglabs/lnd image. For specialized environments where Docker is unavailable, you can trigger a source-based installation by appending the --source flag to the install.sh script. Ensure your target hardware meets the security requirements for hosting key material before finalizing deployment.
Use Cases
This skill is ideal for:
- High-value liquidity providers who want to minimize the risk of a hot-wallet compromise.
- Developers building autonomous trading agents that perform frequent rebalancing without needing access to the master seed.
- Security-conscious Lightning node operators looking to follow 'best-in-class' defense-in-depth practices by separating the signer from the application logic.
Example Prompts
- "Setup a new remote signer on my secure hardware machine and provide the credentials bundle for my agent to import."
- "Verify the connectivity between my watch-only litd node and the external lightning-security-module signer."
- "Rotate my current signer configuration and re-import the updated credentials bundle into my local agent."
Tips & Limitations
- Security Posture: While this adds significant security, the link between the signer and the agent relies on gRPC. Ensure you have properly secured the TLS connection and macaroons.
- Operational Complexity: This architecture requires maintaining two distinct services. If the signer machine is unreachable, your node will be unable to sign new transactions, effectively halting channel management.
- Performance: Ensure minimal latency between the agent and the signer, as signing requests happen in real-time during channel operations.
Metadata
Not sure this is the right skill?
Describe what you want to build — we'll match you to the best skill from 16,000+ options.
Find the right skillPaste this into your clawhub.json to enable this plugin.
{
"plugins": {
"official-roasbeef-lightning-security-module": {
"enabled": true,
"auto_update": true
}
}
}Tags(AI)
Flags: file-write, file-read, network-access
Related Skills
lnd
Install and run Lightning Terminal (litd) which bundles lnd, loop, pool, tapd, and faraday in a single Docker container. Defaults to neutrino backend with SQLite storage on testnet. Supports watch-only mode with remote signer, standalone mode, and regtest development. Use when setting up a Lightning node for payments, channel management, liquidity management (loop), channel marketplace (pool), taproot assets (tapd), or enabling agent L402 commerce.
aperture
Install and run Aperture, the L402 Lightning reverse proxy from Lightning Labs. Use when creating L402 paywalls, configuring paid API endpoints, hosting paid content for other agents, or testing L402 authentication flows.
lightning-mcp-server
Build and configure the MCP server for Lightning Node Connect (LNC). Connects AI assistants to lnd nodes via encrypted WebSocket tunnels using pairing phrases — no direct network access or TLS certs needed. Read-only by default (18 tools for querying node state, channels, payments, invoices, peers, on-chain data).
lnget
Install and use lnget, a Lightning-native HTTP client with automatic L402 payment support. Use when downloading files behind Lightning paywalls, managing L402 tokens, checking Lightning backend status, or making HTTP requests that may require micropayments.
macaroon-bakery
Bake, inspect, and manage lnd macaroons for least-privilege agent access. Use when an agent needs scoped credentials — pay-only, invoice-only, read-only, or custom permissions. Also covers signer macaroon scoping and macaroon rotation.