skills.rest
lightninglabs
lightninglabsOFFICIAL
Explore all skills by this author →
GitHub

lightning-security-module

Separate Lightning private keys from agent-controlled machines via remote signer setup.

57|18|Updated Feb 6, 2026
Search Tags:#docker#lnd#macaroon#lightning-network#remote-signer#watch-only#credentials-bundle
One-click install
npx skills add https://github.com/lightninglabs/lightning-agent-tools --skill lightning-security-module
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: lightning-security-module
Source: https://github.com/lightninglabs/lightning-agent-tools/tree/main/skills/lightning-security-module
Command: npx skills add https://github.com/lightninglabs/lightning-agent-tools --skill lightning-security-module

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires docker, lnd, lncli, jq, curl, openssl, git, go, lsof, tar, base64, sed, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill keeps Lightning private keys separated from the agent runtime, so an AI can manage payments and node operations without ever holding the master seed on the same machine.

Core Features & Use Cases

  • Remote Signer Setup: Creates an lnd signer that stores keys on a dedicated machine and signs only when a watch-only node requests it.
  • Secure Credential Export: Packages accounts.json, TLS certificates, and macaroons for safe import into a watch-only litd or lnd deployment.
  • Container and Native Workflows: Supports Docker-first deployment with native fallback, plus startup, shutdown, and re-export flows for production or test environments.

Quick Start

Ask the agent to install the signer, start it, create the wallet, and export the credentials bundle for a watch-only node.

Frequently Asked Questions about lightning-security-module

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I set up a Lightning Network remote signer to keep private keys off my node?▼

A Lightning Network remote signer keeps private keys on a dedicated machine, signing only when a watch-only lnd or litd node requests it, preventing the agent runtime from holding the master seed.

How do I export macaroons and TLS certificates for a watch-only lnd deployment?▼

Export macaroons and TLS certificates by packaging accounts.json and credentials into a bundle for safe import into a watch-only lnd or litd deployment using authenticated gRPC.

Does the lnd remote signer workflow support Docker and native installations?▼

The lnd remote signer workflow supports Docker-first deployment with native fallback, covering startup, shutdown, and re-export flows across testnet, mainnet, signet, and regtest.

What dependencies do I need to run a Lightning Network remote signer setup?▼

Running a Lightning Network remote signer requires docker, lnd, lncli, jq, curl, openssl, git, go, lsof, tar, base64, and sed to manage wallet creation and credential bundle export.

Why should I use a watch-only lnd node instead of keeping keys locally?▼

Using a watch-only lnd node ensures an AI agent can manage payments and node operations without exposing the master seed on the same machine, reducing key compromise risk.

Can I use litd for remote signing with macaroon-based access control?▼

Yes, litd supports remote signing with macaroon-based access control and authenticated gRPC, allowing watch-only nodes to request signatures from a dedicated remote signer machine.

Related Skills

Explore More Software Engineering Skills→
lightninglabslightninglabs
57

macaroon-bakery

Bake, inspect, and rotate scoped lnd macaroons for least-privilege agent access.

Official
Advanced
lightninglabslightninglabs
57

run-litd

Configure litd and LND node stacks with remote signer on Ubuntu.

Official
Advanced
hairyfhairyf
4

bitcoin

Manage Bitcoin Core nodes, wallets, and PSBT workflows via JSON-RPC and REST.

Community
Advanced
lightninglabslightninglabs
57

lnd

Deploy and manage Lightning Terminal nodes for L402 payments.

Official
Advanced