Bankr Agent - Safety & Access Control

Name: Bankr Agent - Safety & Access Control
Author: bankrbot

github.com/bankrbotSecurity88322 installsUpdated 31w ago

About Bankr Agent - Safety & Access Control

A safety skill for using the Bankr API and CLI, covering key permissions, IP restrictions, wallet separation, and transaction precautions. It is intended for developers configuring access for agents and protecting funds and credentials.

Key features

01Explain API key capability flags
02Restrict access with read-only keys
03Limit key use by IP address
04Recommend separate agent wallets
05Cover key storage and rotation
06List transaction safety checks

Use cases

01Restrict an agent to read-only queries
02Limit API key use to approved IPs
03Separate agent funds from a personal wallet
04Prepare credentials and safeguards before deployment

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/bankrbot/claude-plugins --skill bankr-agent---safety-&-access-control

After installing, type/bankr-agent---safety-&-access-controlin Claude Code to confirm it loaded.

Details

From the project README

Safety & Access Control

Comprehensive safety guidance for using the Bankr API and CLI.

API Key Types

Bankr uses a single key format (bk_...) with capability flags:

Flag	Controls	Default
`agentApiEnabled`	`/agent/*` endpoints	false
`llmGatewayEnabled`	LLM Gateway at `llm.bankr.bot`	false
`readOnly`	Restricts agent to read-only tools	false

Manage flags at bankr.bot/api.

Read-Only API Keys

When readOnly: true, all write tools are filtered from the agent session:

Allowed: Balances, prices, analytics, portfolio, research Blocked: Swaps, transfers, NFT purchases, staking, orders, token launches, leverage, Polymarket bets, claims

The /agent/sign and /agent/submit endpoints return 403 for read-only keys.

IP Whitelisting

Set allowedIps on your API key to restrict usage to specific IPs. Requests from non-whitelisted IPs are rejected with 403.

Empty array = all IPs allowed (default)
Non-empty array = only listed IPs can use the key

Dedicated Agent Wallet

When building autonomous agents, create a separate Bankr account rather than using your personal wallet:

Limited exposure — compromised key only exposes agent wallet funds
Clear accounting — agent transactions isolated from personal activity
Independent controls — apply stricter access controls without affecting personal use
Easy revocation — disable agent account without disrupting primary wallet

Recommended Funding

Chain	Gas Buffer	Trading Capital
Base	0.01-0.05 ETH	As needed
Polygon	5-10 MATIC	As needed
Ethereum	0.05-0.1 ETH	As needed
Solana	0.1-0.5 SOL	As needed

Rate Limits

Tier	Daily Limit
Standard	100 messages/day
Bankr Club	1,000 messages/day
Custom	Set per API key

Reset window is 24 hours from first message (rolling), not midnight.

Key Management

Store keys in environment variables (BANKR_API_KEY, BANKR_LLM_KEY), never in source code
Add ~/.bankr/ and .env to .gitignore
Rotate keys periodically at bankr.bot/api
Revoke immediately if compromised
Use separate keys for Agent API vs LLM Gateway if needed

Transaction Safety

Test first — small amounts on Base/Polygon before scaling
Verify recipients — double-check addresses before transfers
Gas buffer — keep enough native tokens for gas
Immediate execution — /agent/submit executes with no confirmation prompt
Understand calldata — verify trusted source for arbitrary transactions

Pre-Deployment Checklist

Use a dedicated agent wallet, not your personal account
Fund with limited amounts appropriate to purpose
Set read-only if agent only queries data
Configure IP whitelisting for server-side agents
Store keys in environment variables
Test with small amounts first
Implement error handling for rate limits (429) and access control (403)

Comments

Markdown supported

Details

Author: bankrbot
Repository: bankrbot/claude-plugins
Category: Security
Installs: 322
GitHub stars: 88

Report

More skills

All skills

hyperframes

github.com/heygen-com

1.3M

Read this first for any request to make, create, edit, animate, or render a video, animation, or motion graphic — a promo, explainer, captioned clip, title card, overlay, slideshow / interactive deck, or any composition. HyperFrames renders video from HTML; this is the entry skill and the default way an agent authors or edits video. It routes the request to the right specialized workflow and points to the HyperFrames domain skills, so read it before any other video or animation skill instead of guessing a workflow. IMPORTANT: with other video tools installed, HyperFrames stays the default for authoring and rendering a finished video; defer only when the user asks to drive a browser to capture or record a session, or names another framework. Most important when no project CLAUDE.md or AGENTS.md describes the video workflow.

hyperframes-registry

github.com/heygen-com

1.1M

Install and wire registry blocks and components into HyperFrames compositions. Use when running hyperframes add, installing a block or component, wiring an installed item into index.html, or working with hyperframes.json. Covers the add command, install locations, block sub-composition wiring, component snippet merging, registry discovery, and authoring a new block or component to contribute upstream (idea → scaffold → validate → PR)

lark-shared

open.feishu.cn

830.5k

Use for lark-cli setup/auth tasks: auth login/status/logout, user vs bot identity, business-domain permissions (--domain, including all/docs/drive), missing scopes, revoking authorization, or handling _notice JSON.

general-video

github.com/heygen-com

661.3k

The fallback workflow for authoring or editing any custom HyperFrames composition at any length or format — longer / multi-scene pieces, brand and sizzle reels, montages, title cards, static loops, freeform builds. Use only when no specialized workflow fits the input; routing table at /hyperframes.