Requirements
- Target platform
- OpenClaw
- Install method
- Manual import
- Extraction
- Extract archive
- Prerequisites
- OpenClaw
- Primary doc
- SKILL.md
Tencent SkillHub · AI
lnd macaroon bakery
Bake, inspect, and manage lnd macaroons for least-privilege agent access. Use when an agent needs scoped credentials — pay-only, invoice-only, read-only, or custom permissions. Also covers signer macaroon scoping and macaroon rotation.
skill openclawclawhub Free
Bake, inspect, and manage lnd macaroons for least-privilege agent access. Use when an agent needs scoped credentials — pay-only, invoice-only, read-only, or custom permissions. Also covers signer macaroon scoping and macaroon rotation.
⬇ 0 downloads ★ 0 stars Unverified but indexed
Install for OpenClaw
Quick setup
- Download the package from Yavira.
- Extract the archive and review SKILL.md first.
- Import or place the package into your OpenClaw setup.
Package facts
- Download mode
- Yavira redirect
- Package format
- ZIP package
- Source platform
- Tencent SkillHub
- What's included
- SKILL.md, scripts/bake.sh
Validation
- Use the Yavira download entry.
- Review SKILL.md after the package is downloaded.
- Confirm the extracted package contains the expected setup assets.
Install with your agent
Agent handoff
Hand the extracted package to your coding agent with a concrete install brief instead of figuring it out manually.
- Download the package from Yavira.
- Extract it into a folder your agent can access.
- Paste one of the prompts below and point your agent at the extracted folder.
New install
I downloaded a skill package from Yavira. Read SKILL.md from the extracted folder and install it by following the included instructions. Tell me what you changed and call out any manual steps you could not complete.
Upgrade existing
I downloaded an updated skill package from Yavira. Read SKILL.md from the extracted folder, compare it with my current installation, and upgrade it while preserving any custom configuration unless the package docs explicitly say otherwise. Summarize what changed and any follow-up checks I should run.
Trust & source
Release facts
- Source
- Tencent SkillHub
- Verification
- Indexed source record
- Version
- 1.0.0
Provenance
- Publisher
- Roasbeef
- Source page
- View original listing
- Canonical URL
- Open canonical page
Documentation
Macaroon Bakery
Bake custom lnd macaroons so every agent gets only the permissions it needs. Never hand out admin.macaroon in production — bake a scoped one instead.
Quick Start
# Bake a pay-only macaroon skills/macaroon-bakery/scripts/bake.sh --role pay-only # Bake an invoice-only macaroon skills/macaroon-bakery/scripts/bake.sh --role invoice-only # Bake a read-only macaroon skills/macaroon-bakery/scripts/bake.sh --role read-only # Inspect any macaroon skills/macaroon-bakery/scripts/bake.sh --inspect ~/.lnd/data/chain/bitcoin/mainnet/admin.macaroon # List all available lnd permissions skills/macaroon-bakery/scripts/bake.sh --list-permissions
Docker
The litd container is auto-detected. You can also specify --container: # Auto-detect litd container (default) skills/macaroon-bakery/scripts/bake.sh --role pay-only # Explicit container skills/macaroon-bakery/scripts/bake.sh --role pay-only --container litd # Inspect a macaroon inside a container skills/macaroon-bakery/scripts/bake.sh --inspect /root/.lnd/data/chain/bitcoin/testnet/admin.macaroon --container litd
Remote Nodes
To bake macaroons on a remote lnd node, provide the connection credentials: # Bake a pay-only macaroon on a remote node skills/macaroon-bakery/scripts/bake.sh --role pay-only \ --rpcserver remote-host:10009 \ --tlscertpath ~/remote-tls.cert \ --macaroonpath ~/remote-admin.macaroon \ --save-to ~/remote-pay-only.macaroon You need lncli installed locally and copies of the node's TLS cert and a macaroon with macaroon:generate permission (typically admin.macaroon).
Preset Roles
RoleWhat the agent can doCannot dopay-onlyPay invoices, decode invoices, get node infoCreate invoices, open channels, see balancesinvoice-onlyCreate invoices, lookup invoices, get node infoPay, open channels, see wallet balanceread-onlyGet info, balances, list channels/peers/paymentsPay, create invoices, open/close channelschannel-adminAll of read-only + open/close channels, connect peersPay invoices, create invoicessigner-onlySign transactions, derive keys (for remote signer)Everything else
Baking Custom Macaroons
For permissions not covered by presets, bake a custom macaroon: # Custom: agent can only pay and check wallet balance skills/macaroon-bakery/scripts/bake.sh --custom \ uri:/lnrpc.Lightning/SendPaymentSync \ uri:/lnrpc.Lightning/DecodePayReq \ uri:/lnrpc.Lightning/WalletBalance \ uri:/lnrpc.Lightning/GetInfo # Custom with explicit output path skills/macaroon-bakery/scripts/bake.sh --custom \ uri:/lnrpc.Lightning/AddInvoice \ uri:/lnrpc.Lightning/GetInfo \ --save-to ~/my-agent.macaroon
Discovering Permissions
# List all available URI permissions skills/macaroon-bakery/scripts/bake.sh --list-permissions # Filter for specific service skills/macaroon-bakery/scripts/bake.sh --list-permissions | grep -i invoice # Filter for routing-related permissions skills/macaroon-bakery/scripts/bake.sh --list-permissions | grep -i router
Inspecting Macaroons
# See what permissions a macaroon has skills/macaroon-bakery/scripts/bake.sh --inspect <path-to-macaroon> # Inspect the admin macaroon to see full permissions skills/macaroon-bakery/scripts/bake.sh --inspect ~/.lnd/data/chain/bitcoin/mainnet/admin.macaroon
Signer Macaroon Scoping
When using the lightning-security-module skill, the credentials bundle includes admin.macaroon by default. For production, bake a signing-only macaroon on the signer machine: # On the signer container skills/macaroon-bakery/scripts/bake.sh --role signer-only \ --container litd-signer --rpc-port 10012 # Or on a native signer skills/macaroon-bakery/scripts/bake.sh --role signer-only \ --rpc-port 10012 --lnddir ~/.lnd-signer # Then re-export the credentials bundle with the scoped macaroon
Macaroon Rotation
Rotate macaroons regularly to limit the window if one is compromised: # 1. Bake a new macaroon with the same role skills/macaroon-bakery/scripts/bake.sh --role pay-only --save-to ~/pay-only-v2.macaroon # 2. Update your agent config to use the new macaroon # 3. Delete the old macaroon's root key (invalidates it) skills/lnd/scripts/lncli.sh bakemacaroon --root_key_id 0 # Note: use lncli listmacaroonids and deletemacaroonid for fine-grained control
Best Practices
One macaroon per agent role. Don't share macaroons between agents with different responsibilities. Never use admin.macaroon in production. It's the master key. Inspect before deploying. Always verify what a baked macaroon can do. Rotate on a schedule. Monthly for production, immediately if compromised. Scope signer macaroons too. The remote signer's credentials bundle should use signer-only, not admin. Store with 0600 permissions. Macaroons are bearer tokens — treat like passwords.
Common Permission URIs
PermissionDescriptionuri:/lnrpc.Lightning/GetInfoNode info (version, pubkey, sync status)uri:/lnrpc.Lightning/WalletBalanceOn-chain wallet balanceuri:/lnrpc.Lightning/ChannelBalanceLightning channel balanceuri:/lnrpc.Lightning/ListChannelsList open channelsuri:/lnrpc.Lightning/ListPeersList connected peersuri:/lnrpc.Lightning/SendPaymentSyncPay a Lightning invoiceuri:/lnrpc.Lightning/DecodePayReqDecode a BOLT11 invoiceuri:/lnrpc.Lightning/AddInvoiceCreate a Lightning invoiceuri:/lnrpc.Lightning/LookupInvoiceLook up an invoice by hashuri:/lnrpc.Lightning/ListInvoicesList all invoicesuri:/lnrpc.Lightning/ListPaymentsList all paymentsuri:/lnrpc.Lightning/ConnectPeerConnect to a peeruri:/lnrpc.Lightning/OpenChannelSyncOpen a channeluri:/lnrpc.Lightning/CloseChannelClose a channeluri:/signrpc.Signer/SignOutputRawSign a transaction outputuri:/signrpc.Signer/ComputeInputScriptCompute input script for signinguri:/signrpc.Signer/MuSig2SignMuSig2 signinguri:/walletrpc.WalletKit/DeriveKeyDerive a keyuri:/walletrpc.WalletKit/DeriveNextKeyDerive next key in sequence
Category context
Agent frameworks, memory systems, reasoning layers, and model-native orchestration.
Source: Tencent SkillHub
Largest current source with strong distribution and engagement signals.
Package contents
Included in package
1 Docs1 Scripts
- SKILL.md
- scripts/bake.sh