An isolated cryptographic signer that separates private keys from AI agent environments to prevent fund theft and enhance node security.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install lightning-security-module
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install lightning-security-module using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Lightning Security Module?
The Lightning Security Module is a specialized security framework designed to decouple sensitive cryptographic material from active AI agents. By running a remote signer in an isolated container or machine, this Openclaw Skills module ensures that private keys, seeds, and signing logic remain firewalled from the machine running the AI agent or the watch-only node. This architecture is essential for developers building autonomous financial agents who require production-grade security without exposing the wallet's master seed to the agent's execution environment.
This skill automates the setup of a dedicated lnd instance that acts exclusively as a signer. It provides scripts for credential bundling and secure transport, allowing a watch-only node to handle network-heavy tasks like routing and channel management while the signer handles the sensitive work of signing transactions and commitments.
Lightning Security Module Use Cases
- Hardening AI agents that manage autonomous Bitcoin payments by removing private keys from the agent machine.
- Implementing a secure watch-only node architecture for remote monitoring and channel management.
- Protecting lightning funds from potential RCE or supply chain attacks in the agent environment.
- Setting up a dedicated signing server that lacks p2p networking to minimize the attack surface.
How Lightning Security Module Works
- The signer machine installs and starts a hardened lnd container configured specifically for remote signing.
- A secure wallet is initialized on the signer, generating a 24-word seed that never leaves the isolated environment.
- The module generates an authenticated credentials bundle including TLS certificates and admin macaroons.
- This bundle is transferred to the agent machine, where it is imported into a watch-only litd instance.
- The watch-only node connects to the remote signer via gRPC for all cryptographic operations while maintaining the public channel state locally.
Lightning Security Module Setup
Signer Machine Setup
Install the signer image and initialize the secure wallet:
skills/lightning-security-module/scripts/install.sh
skills/lightning-security-module/scripts/start-signer.sh
skills/lightning-security-module/scripts/setup-signer.sh
Agent Machine Setup
Import the generated bundle and launch the watch-only node using Openclaw Skills:
skills/lnd/scripts/import-credentials.sh --bundle <credentials-bundle>
skills/lnd/scripts/start-lnd.sh --watchonly
skills/lnd/scripts/create-wallet.sh
Lightning Security Module Data Schema & Taxonomy
The skill organizes its security metadata and credentials within the ~/.lnget/signer/ directory. The structure is designed for easy export and secure local storage:
| Path | Purpose | Security Level |
|---|---|---|
accounts.json |
Public account xpubs for watch-only sync | Low (Public Info) |
tls.cert |
Signer's TLS certificate for gRPC encryption | Medium (Transport Security) |
admin.macaroon |
RPC authentication token for the signer | High (Restricted Access) |
seed.txt |
24-word mnemonic seed for the signer wallet | Critical (0600 Permissions) |
wallet-password.txt |
Passphrase for unlocking the signer wallet | Critical (0600 Permissions) |
Lightning Security Module Advanced Features
- Support for native (non-docker) installation for ultra-minimalist signing environments.
- Integration with Macaroon Bakery to generate scoped, signing-only permissions for production hardening.
- Automated base64 credential bundling for simplified transfer between remote hosts.
- Custom gRPC and REST interface configuration to facilitate secure firewalling of the signer node.
- Built-in support for Lightning Node Connect (LNC) for read-only agent interfaces via Openclaw Skills servers.
SKILL.md
Loading
Related Openclaw Skills
MCP LNC Server
A secure Model Context Protocol server that connects AI assistants to Lightning nodes using encrypted WebSocket tunnels and 10-word pairing phrases.
Commerce Toolkit
An end-to-end toolkit for agentic commerce using the Lightning Network and L402 protocol to enable autonomous micropayments.
Aperture
A high-performance reverse proxy that implements the L402 protocol to enable Lightning Network payment-gated API access.
OCR Text Recognition
A high-performance OCR tool utilizing PaddleOCR to extract Chinese and English text from images and PDF documents.
Macaroon Bakery
A specialized tool for creating and managing scoped LND macaroons to ensure AI agents operate with least-privilege security.
lnget
A wget-like utility that automatically handles Lightning Network L402 authentication and micropayments for HTTP requests.
Featured*
