How do I install the Bankr Agent - Safety & Access Control skill?

Run npx skillmds@latest add enuno/bankr-agent-safety-access-control in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Bankr Agent - Safety & Access Control safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. Capability flags: makes network calls, reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Bankr Agent - Safety & Access Control?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Bankr Agent - Safety & Access Control free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Bankr Agent - Safety & Access Control?

enuno (@enuno) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Bankr Agent - Safety & Access Control by enuno

Name: Bankr Agent - Safety & Access Control
Rating: 4.5 (4 reviews)
Author: enuno

Bankr Agent - Safety & Access Control

This skill should be used when the user asks about "API key security", "read-only key", "IP whitelist", "rate limits", "dedicated wallet", "agent wallet", "key rotation", "access control", or any safety, security, or access control topic related to Bankr.

enuno Updated Sep 9, 2026 1 repo stars

File contents

Safety & Access Control

Comprehensive safety guidance for using the Bankr API and CLI.

API Key Types

Bankr uses a single key format (bk_...) with capability flags:

Flag	Controls	Default
`agentApiEnabled`	`/agent/*` endpoints	false
`llmGatewayEnabled`	LLM Gateway at `llm.bankr.bot`	false
`readOnly`	Restricts agent to read-only tools	false

Manage flags at bankr.bot/api.

Read-Only API Keys

When readOnly: true, all write tools are filtered from the agent session:

Allowed: Balances, prices, analytics, portfolio, research Blocked: Swaps, transfers, NFT purchases, staking, orders, token launches, leverage, Polymarket bets, claims

The /agent/sign and /agent/submit endpoints return 403 for read-only keys.

IP Whitelisting

Set allowedIps on your API key to restrict usage to specific IPs. Requests from non-whitelisted IPs are rejected with 403.

Empty array = all IPs allowed (default)
Non-empty array = only listed IPs can use the key

Dedicated Agent Wallet

When building autonomous agents, create a separate Bankr account rather than using your personal wallet:

Limited exposure — compromised key only exposes agent wallet funds
Clear accounting — agent transactions isolated from personal activity
Independent controls — apply stricter access controls without affecting personal use
Easy revocation — disable agent account without disrupting primary wallet

Recommended Funding

Chain	Gas Buffer	Trading Capital
Base	0.01-0.05 ETH	As needed
Polygon	5-10 MATIC	As needed
Ethereum	0.05-0.1 ETH	As needed
Solana	0.1-0.5 SOL	As needed

Rate Limits

Tier	Daily Limit
Standard	100 messages/day
Bankr Club	1,000 messages/day
Custom	Set per API key

Reset window is 24 hours from first message (rolling), not midnight.

Key Management

Store keys in environment variables (BANKR_API_KEY, BANKR_LLM_KEY), never in source code
Add ~/.bankr/ and .env to .gitignore
Rotate keys periodically at bankr.bot/api
Revoke immediately if compromised
Use separate keys for Agent API vs LLM Gateway if needed

Transaction Safety

Test first — small amounts on Base/Polygon before scaling
Verify recipients — double-check addresses before transfers
Gas buffer — keep enough native tokens for gas
Immediate execution — /agent/submit executes with no confirmation prompt
Understand calldata — verify trusted source for arbitrary transactions

Pre-Deployment Checklist

Use a dedicated agent wallet, not your personal account
Fund with limited amounts appropriate to purpose
Set read-only if agent only queries data
Configure IP whitelisting for server-side agents
Store keys in environment variables
Test with small amounts first
Implement error handling for rate limits (429) and access control (403)

---name: bankr-agent-safety-access-controldescription: This skill should be used when the user asks about "API key security", "read-only key", "IP whitelist", "rate limits", "dedicated wallet", "agent wallet", "key rotation", "access control", or any safety, security, or access control topic related to Bankr.--- # Safety & Access Control Comprehensive safety guidance for using the Bankr API and CLI. ## API Key Types Bankr uses a single key format (`bk_...`) with capability flags: | Flag | Controls | Default | |------|----------|---------| | `agentApiEnabled` | `/agent/*` endpoints | false | | `llmGatewayEnabled` | LLM Gateway at `llm.bankr.bot` | false | | `readOnly` | Restricts agent to read-only tools | false | Manage flags at [bankr.bot/api](https://bankr.bot/api). ## Read-Only API Keys When `readOnly: true`, all write tools are filtered from the agent session: **Allowed:** Balances, prices, analytics, portfolio, research **Blocked:** Swaps, transfers, NFT purchases, staking, orders, token launches, leverage, Polymarket bets, claims The `/agent/sign` and `/agent/submit` endpoints return 403 for read-only keys. ## IP Whitelisting Set `allowedIps` on your API key to restrict usage to specific IPs. Requests from non-whitelisted IPs are rejected with 403. - Empty array = all IPs allowed (default) - Non-empty array = only listed IPs can use the key ## Dedicated Agent Wallet When building autonomous agents, create a **separate Bankr account** rather than using your personal wallet: - **Limited exposure** — compromised key only exposes agent wallet funds - **Clear accounting** — agent transactions isolated from personal activity - **Independent controls** — apply stricter access controls without affecting personal use - **Easy revocation** — disable agent account without disrupting primary wallet ### Recommended Funding | Chain | Gas Buffer | Trading Capital | |-------|-----------|-----------------| | Base | 0.01-0.05 ETH | As needed | | Polygon | 5-10 MATIC | As needed | | Ethereum | 0.05-0.1 ETH | As needed | | Solana | 0.1-0.5 SOL | As needed | ## Rate Limits | Tier | Daily Limit | |------|-------------| | Standard | 100 messages/day | | Bankr Club | 1,000 messages/day | | Custom | Set per API key | Reset window is 24 hours from first message (rolling), not midnight. ## Key Management - Store keys in environment variables (`BANKR_API_KEY`, `BANKR_LLM_KEY`), never in source code - Add `~/.bankr/` and `.env` to `.gitignore` - Rotate keys periodically at [bankr.bot/api](https://bankr.bot/api) - Revoke immediately if compromised - Use separate keys for Agent API vs LLM Gateway if needed ## Transaction Safety - **Test first** — small amounts on Base/Polygon before scaling - **Verify recipients** — double-check addresses before transfers - **Gas buffer** — keep enough native tokens for gas - **Immediate execution** — `/agent/submit` executes with no confirmation prompt - **Understand calldata** — verify trusted source for arbitrary transactions ## Pre-Deployment Checklist - Use a dedicated agent wallet, not your personal account - Fund with limited amounts appropriate to purpose - Set read-only if agent only queries data - Configure IP whitelisting for server-side agents - Store keys in environment variables - Test with small amounts first - Implement error handling for rate limits (429) and access control (403)

Frequently asked questions