Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
What This Skill Does
Runs an lnd node in a dedicated container or process that holds private keys and performs cryptographic signing, separate from the watch-only litd node that handles routing and channel management. The signer communicates with the watch-only node over authenticated gRPC. Even a fully compromised agent machine cannot extract keys or sign transactions without the signer.
Separating key material means a compromised agent machine can read channel state and balances but cannot sign transactions or extract the seed mnemonic.
When to use it
- Isolating Lightning private keys from an AI agent machine
- Running a watch-only litd node paired with a remote key signer
- Testing a split-custody Lightning setup locally with two containers
- Exporting a credentials bundle to bootstrap a watch-only wallet
- Hardening a production Lightning node against agent-side compromise
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: Set up a remote signer so my AI agent's Lightning node can't access private keys
- 1Runs install.sh on the signer machine to pull the lnd Docker image
- 2Starts the signer container with start-signer.sh
- 3Runs setup-signer.sh to create the wallet and export the credentials bundle
- 4Transfers the credentials bundle to the agent machine and imports it with import-credentials.sh
- 5Starts litd in watch-only mode and creates the watch-only wallet
Watch-only litd node running on the agent machine, connected to the remote signer via gRPC; private keys never leave the signer machine
Requirements
Accounts, API keys, or tools you or your AI assistant may need to set up while using this skill.