bankr agent - safety & access control
This skill should be used when the user asks about "API key security", "read-only key", "IP whitelist", "rate limits", "dedicated wallet", "agent wallet", "key rotation", "access control", or any safety, security, or access control topic related to Bankr.
- Installs
- 322
- Last 24h
- —
- Trending rank
- —
- Security
- Not audited
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/bankrbot/claude-plugins --skill bankr-agent---safety-&-access-control- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads bankr agent - safety & access control automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
Safety & Access Control
Comprehensive safety guidance for using the Bankr API and CLI.
API Key Types
Bankr uses a single key format (bk_...) with capability flags:
| Flag | Controls | Default |
|---|---|---|
agentApiEnabled | /agent/* endpoints | false |
llmGatewayEnabled | LLM Gateway at llm.bankr.bot | false |
readOnly | Restricts agent to read-only tools | false |
Manage flags at bankr.bot/api.
Read-Only API Keys
When readOnly: true, all write tools are filtered from the agent session:
Allowed: Balances, prices, analytics, portfolio, research Blocked: Swaps, transfers, NFT purchases, staking, orders, token launches, leverage, Polymarket bets, claims
The /agent/sign and /agent/submit endpoints return 403 for read-only keys.
IP Whitelisting
Set allowedIps on your API key to restrict usage to specific IPs. Requests from non-whitelisted IPs are rejected with 403.
- Empty array = all IPs allowed (default)
- Non-empty array = only listed IPs can use the key
Dedicated Agent Wallet
When building autonomous agents, create a separate Bankr account rather than using your personal wallet:
- Limited exposure — compromised key only exposes agent wallet funds
- Clear accounting — agent transactions isolated from personal activity
- Independent controls — apply stricter access controls without affecting personal use
- Easy revocation — disable agent account without disrupting primary wallet
Recommended Funding
| Chain | Gas Buffer | Trading Capital |
|---|---|---|
| Base | 0.01-0.05 ETH | As needed |
| Polygon | 5-10 MATIC | As needed |
| Ethereum | 0.05-0.1 ETH | As needed |
| Solana | 0.1-0.5 SOL | As needed |
Rate Limits
| Tier | Daily Limit |
|---|---|
| Standard | 100 messages/day |
| Bankr Club | 1,000 messages/day |
| Custom | Set per API key |
Reset window is 24 hours from first message (rolling), not midnight.
Key Management
- Store keys in environment variables (
BANKR_API_KEY,BANKR_LLM_KEY), never in source code - Add
~/.bankr/and.envto.gitignore - Rotate keys periodically at bankr.bot/api
- Revoke immediately if compromised
- Use separate keys for Agent API vs LLM Gateway if needed
Transaction Safety
- Test first — small amounts on Base/Polygon before scaling
- Verify recipients — double-check addresses before transfers
- Gas buffer — keep enough native tokens for gas
- Immediate execution —
/agent/submitexecutes with no confirmation prompt - Understand calldata — verify trusted source for arbitrary transactions
Pre-Deployment Checklist
- Use a dedicated agent wallet, not your personal account
- Fund with limited amounts appropriate to purpose
- Set read-only if agent only queries data
- Configure IP whitelisting for server-side agents
- Store keys in environment variables
- Test with small amounts first
- Implement error handling for rate limits (429) and access control (403)
FAQ
What does the bankr agent - safety & access control skill do?
This skill should be used when the user asks about "API key security", "read-only key", "IP whitelist", "rate limits", "dedicated wallet", "agent wallet", "key rotation", "access control", or any safety, security, or access control topic related to Bankr.
How do I install bankr agent - safety & access control?
Run npx skills add https://github.com/bankrbot/claude-plugins --skill bankr-agent---safety-&-access-control in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/bankr-agent---safety-&-access-control/ (personal) or .claude/skills/bankr-agent---safety-&-access-control/ (project).
Which AI agents can use bankr agent - safety & access control?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is bankr agent - safety & access control safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains bankr agent - safety & access control?
It is published by bankrbot in bankrbot/claude-plugins. It has 322 recorded installs.
More from bankrbot/claude-plugins
bankr agent - transfers
bankrbot/claude-plugins
This skill should be used when the user asks to "send tokens", "transfer ETH", "send to ENS", "transfer to wallet", "send to @username", "transfer to Farcaster", "send to Twitter handle", or any asset transfer operation. Provides guidance on recipient resolution and transfer formats.
bankr x402 sdk - balance queries
bankrbot/claude-plugins
This skill should be used when the user asks "what are my balances", "how much ETH do I have", "check my wallet", "show my tokens", "portfolio value", "what tokens do I own", "NFT holdings", "how much USDC", "get token balances", "wallet contents", or any question about token balances, wallet contents, portfolio values, or NFT holdings across chains using the Bankr SDK.
bankr dev - nft operations
bankrbot/claude-plugins
Open the skill to read its SKILL.md instructions.
bankr dev - transfers
bankrbot/claude-plugins
This skill should be used when building payment systems, implementing token transfers, or adding ENS/social handle resolution. Supports wallet addresses, ENS names, and social handles.
bankr agent - job workflow
bankrbot/claude-plugins
Open the skill to read its SKILL.md instructions.
bankr dev - market research
bankrbot/claude-plugins
This skill should be used when building market data displays, implementing price feeds, or adding technical analysis. Covers prices, market caps, technical analysis, sentiment, and trending tokens.
Popular security skills
azure-compliance
microsoft/azure-skills
Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment.
minimal-run-and-audit
lllllllama/rigorpilot-skills
Rigor Run skill for README-first deep learning repo reproduction. Use when the task is specifically to capture or normalize evidence from the selected smoke test or documented inference or evaluation command and write standardized reprooutputs/ files, including patch notes when repository files changed. Do not use for training execution, initial repo intake, generic environment setup, paper lookup, target selection, hidden scientific-meaning changes, or end-to-end orchestration by itself.
seo-audit
coreyhaines31/marketingskills
When the user wants to audit, review, or diagnose SEO issues on their site. Also use when the user mentions "SEO audit," "technical SEO," "why am I not ranking," "SEO issues," "on-page SEO," "meta tags review," "SEO health check," "my traffic dropped," "lost rankings," "not showing up in Google," "site isn't ranking," "Google update hit me," "page speed," "core web vitals," "crawl errors," "indexing issues," "stuck on page 2," "striking distance keywords," "title tag rewrite," "low CTR," "local SEO," "Google Business Profile," or "map pack." Use this even if the user just says something vague like "my SEO is bad" or "help with SEO" — start with an audit. For building pages at scale to target keywords, see programmatic-seo. For adding structured data, see schema. For AI search optimization, see ai-seo.
firebase-security-rules-auditor
firebase/agent-skills
Audits Firebase (Firestore, Cloud Storage) security rules for vulnerabilities, privilege escalation, role bypasses, create vs update inconsistencies, resource exhaustion, type safety, size limits, and hasOnly ownership checks. Use when auditing/reviewing rules, running red-team rule assessments, or scoring against auditor checklists. Don't use for Firebase CLI (login, deploy), Auth, Crashlytics, Remote Config, or database queries.
audit
pbakaus/impeccable
Run technical quality checks across accessibility, performance, theming, responsive design, and anti-patterns. Generates a scored report with P0-P3 severity ratings and actionable plan. Use when the user wants an accessibility check, performance audit, or technical quality review.
competitors
coreyhaines31/marketingskills
When the user wants to create competitor comparison or alternative pages for SEO and buyer-facing use. Also use when the user mentions 'alternative page,' 'vs page,' 'competitor comparison,' 'comparison page,' '[Product] vs [Product],' '[Product] alternative,' 'competitive landing pages,' 'how do we compare to X,' 'competitor teardown,' 'audit our competitor pages,' 'are our comparison pages out of date,' or 'competitive asset audit.' Use this for any content that positions your product against competitors. Covers four formats: singular alternative, plural alternatives, you vs competitor, and competitor vs competitor. For auditing existing claims (not researching competitors from scratch, which is competitor-profiling; not technical SEO on these pages, which is seo-audit), use the asset audit here. For internal battle cards and sales-specific competitor docs, see sales-enablement.