LNBits Wallet wtih QR Code

Manage LNbits Lightning Wallet (Balance, Pay, Invoice)

Security Scan

The skill's code, runtime instructions, and requested credentials match its stated purpose (managing an LNbits wallet); there are a few small implementation/packaging inconsistencies to be aware of but nothing that indicates misdirection or malicious intent.

Purpose & Capability

Name/description (balance, invoice, pay, qr) align with the shipped Python CLI. Required environment variables (LNBITS_API_KEY, LNBITS_BASE_URL) and python3 are appropriate for talking to an LNbits instance. The primaryEnv is correctly set to the API key.

Instruction Scope

SKILL.md instructs the assistant to run the included CLI and to never display secrets and to always ask confirmation before payments — that is appropriate. It does require the assistant to follow an exact output format for presenting QR media (a single-line 'MEDIA:...'), which is fragile but consistent with how the CLI writes QR files. The instructions do not ask the agent to read unrelated files or exfiltrate data.

Install Mechanism

There is no install spec (instruction-only), which is low risk. SKILL.md metadata lists a pip dependency (qrcode[pil]) but the registry install section does not declare or perform installation; the CLI includes a graceful fallback when the qrcode package is missing. Users will need to ensure qrcode[pil] is installed if they want QR file output.

Credentials

Only LNBITS_API_KEY and LNBITS_BASE_URL are required; both are reasonable and proportional to the skill's functionality. The script uses the API key for authenticated requests; the create-wallet flow intentionally posts to the account endpoint without an API key (expected for creating a new account on a demo instance).

Persistence & Privilege

The skill does not request always:true or any elevated persistence. It writes short-lived QR PNG files into a .lnbits_qr directory under the agent working directory and cleans files older than 5 minutes; this is a limited, scoped filesystem write for media delivery.

Assessment

This skill appears to do what it says: it calls your configured LNbits server using LNBITS_BASE_URL and LNBITS_API_KEY and can create invoices, show balances, generate QR PNGs, decode and pay bolt11 invoices. Before installing: (1) store LNBITS_API_KEY securely and never paste the adminkey into chat — the create-wallet command prints the adminkey to the terminal and the skill explicitly warns not to repeat it; (2) install the Python dependency qrcode[pil] if you want QR files to be generated (the script will still run but will report a missing qrcode library if not installed); (3) be aware the skill will write temporary PNG files under .lnbits_qr in the agent's working directory for up to ~5 minutes (ensure you’re comfortable with those files being created); (4) verify the LNBITS_BASE_URL is the instance you expect (default points to legend.lnbits.com); and (5) if you want stricter guarantees, review the included scripts/lnbits_cli.py locally to confirm there are no unexpected network endpoints or behavior.

LNbits Wallet Manager - Staj

Enable the assistant to safely and effectively manage an LNbits Lightning Network wallet.

🛑 CRITICAL PROTOCOLS - Staj 🛑

1. NEVER Expose Secrets: Do NOT display Admin Keys, User IDs, or Wallet IDs.
2. Explicit Confirmation: You MUST ask for "Yes/No" confirmation before paying.
   • Format: "I am about to send [Amount] sats to [Memo/Dest]. Proceed? (y/n)"
3. Check Balance First: Always call balance before pay to prevent errors.
4. ALWAYS Include Invoice + QR: When generating an invoice, you MUST: (a) show the payment_request text for copying, and (b) output MEDIA: followed by the qr_file path on ONE line. NEVER skip this.

Usage

0. Setup / Create Wallet

If the user does not have an LNbits wallet, you can create one for them on the demo server.

python3 {baseDir}/scripts/lnbits_cli.py create --name "My Wallet"

Action:

1. Run the command. The CLI prints JSON containing adminkey and base_url to stdout (visible in the terminal).
2. NEVER Expose Secrets (applies here): Do NOT repeat, quote, or display the adminkey or any secret from the output in your chat response. The user sees the command output in their terminal; that is the only place the key should appear.
3. Instruct the user in plain language only, e.g.:

   "A new wallet was created. The command output above contains your adminkey and base_url. Copy those values from the terminal and add them to your configuration or .env as LNBITS_API_KEY and LNBITS_BASE_URL. Do not paste the adminkey here or in any chat."

1. Check Balance

Get the current wallet balance in Satoshis.

python3 {baseDir}/scripts/lnbits_cli.py balance

2. Create Invoice (Receive)

Generate a Bolt11 invoice to receive funds. QR code is always included by default.

• amount: Amount in Satoshis (Integer).
• memo: Optional description.
• --no-qr: Skip QR code generation (if not needed).

# Invoice with QR code (default)
python3 {baseDir}/scripts/lnbits_cli.py invoice --amount 1000 --memo "Pizza"

# Invoice without QR code
python3 {baseDir}/scripts/lnbits_cli.py invoice --amount 1000 --memo "Pizza" --no-qr

⚠️ MANDATORY RESPONSE FORMAT: When generating an invoice, your response MUST include:

1. Invoice text for copying: Show the full payment_request string so user can copy it
2. QR code image: Output MEDIA: followed by the qr_file path on ONE line

EXACT FORMAT (follow precisely):

Here is your 100 sat invoice:

lnbc1u1p5abc123...

MEDIA:./clawd/.lnbits_qr/invoice_xxx.png

CRITICAL: The MEDIA: and file path MUST be on the SAME LINE. This sends the QR code image to the user.

2b. Generate QR Code from Existing Invoice

Convert any Bolt11 string to a QR code image file.

python3 {baseDir}/scripts/lnbits_cli.py qr <bolt11_string>

Returns: {"qr_file": "./.lnbits_qr/invoice_xxx.png", "bolt11": "..."}

3. Pay Invoice (Send)

⚠️ REQUIRES CONFIRMATION: Decode first, verify balance, ask user, then execute.

# Step 1: Decode to verify amount/memo
python3 {baseDir}/scripts/lnbits_cli.py decode <bolt11_string>

# Step 2: Pay (Only after user CONFIRMS)
python3 {baseDir}/scripts/lnbits_cli.py pay <bolt11_string>

Error Handling

If the CLI returns a JSON error (e.g., {"error": "Insufficient funds"}), summarize it clearly for the user. Do not show raw stack traces.