Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
What This Skill Does
Bakes scoped lnd macaroons so each agent receives only the permissions it needs. Supports preset roles (pay-only, invoice-only, read-only, channel-admin, signer-only) and custom URI-level permission sets. Works with local nodes, Docker containers, and remote lnd instances.
Baking per-role macaroons eliminates the need to distribute admin.macaroon, reducing blast radius if any single agent credential is compromised.
When to use it
- Issuing pay-only credentials to a payment bot without exposing channel management
- Giving a billing service invoice-only access to create and look up invoices
- Scoping signer credentials on a dedicated remote signing node
- Rotating a macaroon after a suspected credential leak
- Auditing what permissions an existing macaroon grants before deployment
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: create a pay-only macaroon for a payment agent
- 1Run bake.sh --role pay-only to bake a scoped macaroon
- 2Script auto-detects the litd container and connects to lnd via RPC
- 3Inspect the output macaroon with --inspect to verify granted URIs
- 4Store the macaroon file with 0600 permissions and pass the path to the agent
A pay-only macaroon file granting SendPaymentSync, DecodePayReq, and GetInfo — and nothing else
Requirements
Accounts, API keys, or tools you or your AI assistant may need to set up while using this skill.