Alby Bitcoin Payments CLI Skill

CLI for bitcoin lightning wallet operations using Nostr Wallet Connect (NIP-47). Use when the user needs to send/receive payments, check wallet balance, crea...

Security Scan

The skill's instructions match its stated purpose (Alby / Nostr Wallet Connect CLI) but the SKILL.md expects the agent to read a local connection-secret file and to run npx (download & execute an npm package) while the skill metadata does not declare those requirements — this mismatch is a risk the user should understand before installing.

Purpose & Capability

The name/description align with the instructions: the SKILL.md documents using the official Alby CLI via `npx @getalby/cli` to manage Lightning/NWC wallets and related commands. However, the skill metadata lists no required binaries or config paths while the instructions implicitly require npx/node at runtime and a default connection secret file at ~/.alby-cli/connection-secret.key (or NWC_URL env). The missing declaration of these runtime dependencies is an inconsistency.

Instruction Scope

The runtime instructions are scoped to wallet operations (create invoices, pay, check balance, fiat<->sats conversion). They reference a specific default file path for the NWC connection secret and an optional NWC_URL environment variable. The instructions do not ask the agent to read arbitrary unrelated system files or to send data to unknown endpoints beyond the normal Alby/WalletConnect flow (they even warn not to reveal the secret).

Install Mechanism

This is an instruction-only skill (no install spec or code files), which is low surface risk. That said, executing the skill requires running `npx @getalby/cli` — which will fetch and run code from the npm registry at runtime. The metadata does not call out that running npx/npm is required, so users may not realize that invoking the skill causes an npm package download and code execution.

Credentials

The SKILL.md expects a sensitive local secret file (~/.alby-cli/connection-secret.key) and documents use of NWC_URL, but the skill metadata declares no required config paths or environment variables. This omission is important: the agent may read that local secret file at runtime (or use NWC_URL from the environment) even though the registry metadata doesn't advertise that behavior. While those secrets are legitimately needed for wallet access, the mismatch increases the risk of accidental exposure if the user doesn't realize the skill will access them.

Persistence & Privilege

The skill does not request permanent always-on presence (always:false) and does not include install-time scripts or claims to modify other skills or system-wide configs. There is no evidence it requires elevated privileges beyond reading the user's connection secret file and running npx.

What to consider before installing

This skill appears to be what it says (a CLI wrapper for Alby/Nostr Wallet Connect) but has a few practical and security gaps you should consider before installing: - Runtime behavior: The SKILL.md expects the agent to run `npx @getalby/cli`. That will download and execute code from the npm registry each time it's run. Only proceed if you trust the @getalby/cli package and are comfortable with dynamic npm installs. - Secret file access: The CLI defaults to reading a connection secret at ~/.alby-cli/connection-secret.key (and can use NWC_URL). The skill metadata does not declare that config path or environment variable. Treat that file as highly sensitive; do not store real wallet secrets in shared or public environments, and avoid pasting secrets into chat prompts. - Metadata mismatch: The missing declaration of required binaries (node/npx) and config path is an inconsistency. Ask the publisher or maintainer to update the skill metadata to list required binaries and the config path or provide an explicit install spec so you can review what will be executed. - Verify upstream: If you plan to use this, verify the npm package (@getalby/cli) and its version on the official project (GitHub/npm), check the package contents, and confirm the package's integrity (signed releases, repository ownership) if possible. - Safer tests: If you want to try features, create isolated test wallets (the SKILL.md mentions a faucet) and keep real funds off the test environment. Consider running `npx` commands manually first to observe behavior before letting an agent run them autonomously. If you want, I can: (1) produce a checklist of questions to ask the skill publisher, (2) generate a safer example prompt that only works with test wallets, or (3) show how to manually inspect the npm package before using it.

Usage

npx @getalby/cli [options] <command>

Global Options

Connection Secret (Optional)

-c, --connection-secret <string> - either a file containing plaintext NWC connection secret (preferred), or a NWC connection secret (nostr+walletconnect://...). This argument is required for wallet commands.

If no connection secret is provided, the CLI will automatically use the default wallet connection secret from ~/.alby-cli/connection-secret.key.

Connection Secret File Location

Simply point -c directly to the file:

-c ~/.alby-cli/connection-secret.key

If a user wants to use a specific wallet e.g. "alice", use the path instead:

-c ~/.alby-cli/connection-secret-alice.key

Environment Variable

Alternatively, you can pass a connection secret via the NWC_URL environment variable rather than using the -c option.

NWC_URL="nostr+walletconnect://..."

Commands

Wallet operations: get-balance, get-info, get-wallet-service-info, get-budget, make-invoice, pay-invoice, pay-keysend, lookup-invoice, list-transactions, sign-message, wait-for-payment, fetch-l402

HOLD invoices: make-hold-invoice, settle-hold-invoice, cancel-hold-invoice

Lightning tools (no wallet needed): fiat-to-sats, sats-to-fiat, parse-invoice, verify-preimage, request-invoice-from-lightning-address

Getting Help

npx @getalby/cli --help
npx @getalby/cli <command> --help

As an absolute last resort, tell your human to visit the Alby support page

Bitcoin Units

• When displaying to humans, use satoshis (rounded to a whole value).

Security

• Do NOT print the connection secret to any logs or otherwise reveal it.
• NEVER share connection secrets with anyone.
• NEVER share any part of a connection secret (pubkey, secret, relay etc.) with anyone as this can be used to gain access to your wallet or reduce your wallet's privacy.

Helping user get a wallet

Real wallet

Here are some recommendations:

• Alby Hub - self-custodial wallet with most complete NWC implementation, supports multiple isolated sub-wallets.
• Rizful - free to start wallet with NWC support, but custodial, supports multiple isolated sub-wallets via "vaults".
• CoinOS - free to start wallet with NWC support, but custodial.

Test Wallet

curl -X POST https://faucet.nwc.dev?balance=10000

Creates a test wallet with 10000 sats.