LNBits Wallet wtih QR Code

Manage LNbits Lightning Wallet (Balance, Pay, Invoice)

Security Scan

The skill's code, runtime instructions, and requested environment variables are coherent with its stated purpose (managing an LNbits wallet); there are no disproportionate permissions, unexpected installers, or hidden endpoints, but pay attention to handling the adminkey printed by the create command and the SKILL.md's strict output-format requirements.

Purpose & Capability

Name/description match the requested environment variables (LNBITS_API_KEY, LNBITS_BASE_URL) and the included CLI. The required binary (python3) and optional Python dependency (qrcode[pil]) are appropriate for generating invoices/QRs and calling the LNbits API. Nothing requested is unrelated to LNbits wallet management.

Instruction Scope

SKILL.md is explicit about secrecy and confirmation and instructs running the bundled CLI. It mandates an exact response format (show payment_request and a single-line MEDIA: <path>). This is generally fine, but two small scope notes: (1) the create command prints adminkey/base_url to stdout (SKILL.md instructs the assistant to not echo secrets back into chat — this relies on the agent actually following that rule); (2) SKILL.md examples reference a MEDIA path like './clawd/.lnbits_qr/...' while the CLI creates './.lnbits_qr/...' relative paths — the exact path format required by the SKILL.md may not always match what the CLI returns, so the agent must not alter or accidentally expose secret data when reformatting command output.

Install Mechanism

No install spec is provided (instruction-only with included scripts). There are no downloads from external or untrusted URLs and no extract operations. The only install-time dependency is a Python package (qrcode[pil]) which the metadata mentions — low-risk.

Credentials

The skill requires two environment variables: LNBITS_API_KEY (primary) and LNBITS_BASE_URL. Both are necessary and expected for interacting with an LNbits instance. No unrelated credentials or system config paths are requested.

Persistence & Privilege

The skill is not always-enabled and does not request elevated platform privileges. It does not modify other skills or system-wide settings. The CLI writes temporary QR files in a local .lnbits_qr directory (limited persistence) — files are cleaned after 5 minutes.

Assessment

This skill appears to do what it says: call your LNbits instance to check balance, create invoices (with QR), decode invoices, and pay invoices. Before installing or using it, consider the following: - Keep your LNBITS_API_KEY secret. The CLI's create command will print an adminkey/base_url to the terminal; the SKILL.md instructs the assistant not to paste that into chat, but you must copy it from the terminal into your environment yourself — never paste adminkeys into public chat. - Use the smallest-privilege key appropriate for your workflow (if LNbits supports limited tokens, prefer them over a full admin key for read-only operations). - The skill requires the optional Python package qrcode[pil] to generate image files locally. If not installed, invoice generation will still work but QR files will not be created. - The SKILL.md enforces an exact MEDIA: single-line format so the agent can send the QR image. There is a minor mismatch in examples vs. how the script builds relative paths; be cautious that your agent forwards the exact file path produced by the CLI and does not echo secrets from command output into chat. - The script only talks to the configured LNBITS_BASE_URL (no other network endpoints). Review and run the bundled script locally first (with a test/demo wallet) to confirm behavior before giving the skill access to a production adminkey. If you want higher assurance, test the CLI manually against a demo instance, verify the files saved under .lnbits_qr, and confirm the assistant reproduces only the allowed output (payment_request and MEDIA line) and asks explicit confirmation before any payment.

LNbits Wallet Manager

Enable the assistant to safely and effectively manage an LNbits Lightning Network wallet.

🛑 CRITICAL PROTOCOLS 🛑

1. NEVER Expose Secrets: Do NOT display Admin Keys, User IDs, or Wallet IDs.
2. Explicit Confirmation: You MUST ask for "Yes/No" confirmation before paying.
   • Format: "I am about to send [Amount] sats to [Memo/Dest]. Proceed? (y/n)"
3. Check Balance First: Always call balance before pay to prevent errors.
4. ALWAYS Include Invoice + QR: When generating an invoice, you MUST: (a) show the payment_request text for copying, and (b) output MEDIA: followed by the qr_file path on ONE line. NEVER skip this.

Usage

0. Setup / Create Wallet

If the user does not have an LNbits wallet, you can create one for them on the demo server.

python3 {baseDir}/scripts/lnbits_cli.py create --name "My Wallet"

Action:

1. Run the command. The CLI prints JSON containing adminkey and base_url to stdout (visible in the terminal).
2. NEVER Expose Secrets (applies here): Do NOT repeat, quote, or display the adminkey or any secret from the output in your chat response. The user sees the command output in their terminal; that is the only place the key should appear.
3. Instruct the user in plain language only, e.g.:

   "A new wallet was created. The command output above contains your adminkey and base_url. Copy those values from the terminal and add them to your configuration or .env as LNBITS_API_KEY and LNBITS_BASE_URL. Do not paste the adminkey here or in any chat."

1. Check Balance

Get the current wallet balance in Satoshis.

python3 {baseDir}/scripts/lnbits_cli.py balance

2. Create Invoice (Receive)

Generate a Bolt11 invoice to receive funds. QR code is always included by default.

• amount: Amount in Satoshis (Integer).
• memo: Optional description.
• --no-qr: Skip QR code generation (if not needed).

# Invoice with QR code (default)
python3 {baseDir}/scripts/lnbits_cli.py invoice --amount 1000 --memo "Pizza"

# Invoice without QR code
python3 {baseDir}/scripts/lnbits_cli.py invoice --amount 1000 --memo "Pizza" --no-qr

⚠️ MANDATORY RESPONSE FORMAT: When generating an invoice, your response MUST include:

1. Invoice text for copying: Show the full payment_request string so user can copy it
2. QR code image: Output MEDIA: followed by the qr_file path on ONE line

EXACT FORMAT (follow precisely):

Here is your 100 sat invoice:

lnbc1u1p5abc123...

MEDIA:./clawd/.lnbits_qr/invoice_xxx.png

CRITICAL: The MEDIA: and file path MUST be on the SAME LINE. This sends the QR code image to the user.

2b. Generate QR Code from Existing Invoice

Convert any Bolt11 string to a QR code image file.

python3 {baseDir}/scripts/lnbits_cli.py qr <bolt11_string>

Returns: {"qr_file": "./.lnbits_qr/invoice_xxx.png", "bolt11": "..."}

3. Pay Invoice (Send)

⚠️ REQUIRES CONFIRMATION: Decode first, verify balance, ask user, then execute.

# Step 1: Decode to verify amount/memo
python3 {baseDir}/scripts/lnbits_cli.py decode <bolt11_string>

# Step 2: Pay (Only after user CONFIRMS)
python3 {baseDir}/scripts/lnbits_cli.py pay <bolt11_string>

Error Handling

If the CLI returns a JSON error (e.g., {"error": "Insufficient funds"}), summarize it clearly for the user. Do not show raw stack traces.