Sparkbtcbot — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Sparkbtcbot (Plugin) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Spark Bitcoin L2 wallet skill for AI agents — give an agent its own Bitcoin wallet so it can send and receive money on its own: pay for an API call, get paid for a task, tip, or settle up, without a human signing off on every transaction.
Built on Spark, a Bitcoin Layer 2 with instant, near-zero-fee transfers and native Lightning support — and fully self-custodial, so the agent holds its own keys. Use it in Claude Code as a plugin, or in any other LLM agent framework via the npm package.
Spark is a Bitcoin Layer 2 that lets you send and receive Bitcoin instantly with low fees. Spark-to-Spark transfers are free, and Lightning interop costs 0.15–0.25%. It is fully self-custodial — you hold your own keys via a BIP39 mnemonic — and fully interoperable with the Lightning Network. Spark currently has a small number of infrastructure providers (Signing Operators), so there is some risk of downtime, and it requires trusting that at least one operator behaves honestly during transfers.
Two install paths depending on your stack.
claude plugin marketplace add https://github.com/echennells/sparkbtcbot-skill
claude plugin install sparkbtcbotNative plugin install. Updates flow through claude plugin update sparkbtcbot. Claude reads SKILL.md automatically when the skill triggers.
npm install sparkbtcbot-skillThe package ships both the skill content (so you can load it into your LLM's context) and the encryption library (so generated code can import the helpers). Minimal use:
import { getSkillContent, getReference, listReferences } from "sparkbtcbot-skill";
// Always-loaded skill body — pass to your framework's system-prompt mechanism
const instructions = await getSkillContent();
// On-demand reference docs by name
console.log(await listReferences());
// → ['agent-class', 'architecture', 'encrypted-seed', 'extras', 'l402',
// 'lightning', 'spark-invoices', 'tokens', 'wallet']
const l402Doc = await getReference("l402");Generated code (or your own glue) can also import the encryption helpers:
import { saveEncryptedMnemonic, loadMnemonicFromEnv } from "sparkbtcbot-skill";
await saveEncryptedMnemonic({ mnemonic, passphrase, path: "./seed.enc" });
const decrypted = await loadMnemonicFromEnv(); // reads SPARK_PASSPHRASEThe package has zero runtime dependencies beyond Node 18+ built-ins.
git clone https://github.com/echennells/sparkbtcbot-skill.git ~/.claude/skills/sparkbtcbot-skill
cd ~/.claude/skills/sparkbtcbot-skill
npm installThe Quick Start below assumes this path — useful if you want to kick the tires on the example scripts (npm run example:balance etc.) before integrating.
# Install dependencies (in the cloned skill directory)
cd ~/.claude/skills/sparkbtcbot-skill
npm install
# Copy env template, set SPARK_PASSPHRASE (>=12 chars)
cp .env.example .env
$EDITOR .env
# One-time setup: generate a wallet, encrypt the mnemonic at ~/.spark/seed.enc.
# This also writes a backup file (~/.spark/MNEMONIC_BACKUP_*.txt, mode 0600)
# containing the 12 words; setup prints the path.
npm run setup
# Back up the mnemonic offline (paper / password manager / hardware backup),
# then delete the backup file:
cat ~/.spark/MNEMONIC_BACKUP_*.txt # confirm path matches what setup printed
rm ~/.spark/MNEMONIC_BACKUP_*.txt # AFTER you have a copy offline
# Run the examples
npm run example:balance
npm run example:paymentsThe mnemonic is never stored in plaintext anywhere the runtime reads. npm run setup writes an encrypted seed file (~/.spark/seed.enc, mode 0600); the runtime reads SPARK_PASSPHRASE from env and decrypts it once at boot. The backup file from setup is a one-time artifact for the user to copy from — it does not auto-delete; you rm it once you have an offline backup. See skills/sparkbtcbot/references/encrypted-seed.md for the threat model and recovery scenarios.
| Script | npm script | Purpose |
|---|---|---|
setup-encrypted-seed.js | npm run setup | Generate wallet, encrypt mnemonic at rest |
balance-and-deposits.js | npm run example:balance | Check balance (BTC + tokens), get deposit addresses |
payment-flow.js | npm run example:payments | Lightning invoices, Spark invoices, fee estimation |
token-operations.js | npm run example:tokens | BTKN token balances, transfers, batch operations |
l402-paywalls.js | npm run example:l402 | Access L402 pay-per-request APIs via Lightning |
spark-agent.js | npm run example:agent | Complete SparkAgent class with all capabilities |
| Variable | Required | Description |
|---|---|---|
SPARK_PASSPHRASE | Yes | Passphrase (≥12 chars) that decrypts the seed file at boot. Set during npm run setup. |
SPARK_NETWORK | No | MAINNET (default), REGTEST, TESTNET, SIGNET |
SPARK_SEED_PATH | No | Override for the encrypted-seed file location. Defaults to ~/.spark/seed.enc. |
SPARK_ACCOUNT_NUMBER | No | BIP32 account index. Defaults: 1 (MAINNET), 0 (REGTEST) |
npm install @buildonspark/spark-sdk dotenv light-bolt11-decoderPassphrase + seed file = full wallet access. Either alone is useless; both together control all funds. There is no permission scoping, no spending limits, no read-only mode in the SDK.
Recommendations:
SPARK_PASSPHRASE like any production secret (deployment secret manager, .env in .gitignore, etc.)seed.enc into container images that ship alongside the passphraseaccountNumber values for different funding tiersMIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.