Add rh-wallet skill (Robinhood Crypto via RH Wallet Gateway)

[anondevv69]

Summary

Adds the rh-wallet skill for RH Wallet — stateless Robinhood Crypto (US) trading via a hosted signing gateway.

• Check buying power, holdings, bid/ask, and estimates on pairs like BTC-USD
• Market buy/sell (host cap $50/order, confirmation required)
• User keys stay in Bankr Agent tool environment (RH_API_KEY + RH_PRIVATE_KEY_BASE64) — gateway signs only, does not store keys
• Hosted gateway URL + public invite secret baked into skill defaults
• Wallet routing docs disambiguate from Bankr onchain, hoodmarkets (Robinhood Chain 0x…), and Agentic MCP (stocks)
• Response safety — never post account numbers or credentials on X; gateway redacts account_number

Gateway: https://rh-wallet-production.up.railway.app
Source repo: https://github.com/anondevv69/RH-Wallet

Install (after merge)

install the rh-wallet skill from https://github.com/BankrBot/skills/tree/main/rh-wallet

User env (Bankr → Agent tool environment)

Variable	Required
RH_API_KEY	Yes
RH_PRIVATE_KEY_BASE64	Yes
RH_GATEWAY_SECRET	No (default in skill)
RH_WALLET_API_URL	No (default in skill)

Test plan

• catalog.json validates (slug = folder name rh-wallet)
• Install skill in Bankr terminal / X
• With RH keys in env: “What's my Robinhood Crypto buying power?”
• “Robinhood price of BTC-USD”
• Contract address buy (0x…) → skill refuses, routes to onchain/hoodmarkets per WALLET-ROUTING.md
• Public reply omits account_number

Security notes (aligned with github-vesting review themes)

• Pinned gateway host in known-gateway.json + API-HOST.md allowlist
• No Bankr /wallet/submit — curl-only to gateway; RH keys in user env
• Local reply formatting — no third-party replyText relay
• Explicit disambiguation from hoodmarkets to prevent wrong-wallet trades

Made with Cursor

[saltoriousSIG]

Looks good! just a couple things to address

• The skill sends the long-lived Robinhood API key and Ed25519 private signing key to a third-party Railway gateway, and x402 additionally exposes them to x402.bankr.bot. “Stateless” does not remove credential-theft or logging risk. Require a locally run, source/version-pinned signer so private keys never leave the user-controlled environment. At minimum, document all processors, redaction guarantees, key scope, rotation/revocation, and dedicated-key requirements.

• The x402 commands use --yes without validating or previewing payment terms. Pin the Base chain ID, USDC contract, facilitator/payee, resource path, and maximum atomic price for every endpoint. Require payment confirmation, spend caps, idempotency, and no blind retries.

• Trade confirmation is incomplete and inconsistent. Before every crypto, equity, option, or cancellation write, preview the exact account/product, canonical instrument, side, order type, quantity/notional, quote, fees, time-in-force, maximum drift/loss, and x402 fee. Require final confirmation in every channel, expiring it when any field changes.

• Successful gateway/MCP responses are not followed by authoritative order verification. Poll Robinhood using the exact order ID, validate the order against confirmed intent, and report fills only from final status with actual price, quantity, and fees. After ambiguous failures, look up the order before any retry.

• The Robinhood Agentic MCP lacks OAuth scope and permission boundaries. Require explicit installation approval, read-only scopes by default, separate approval for trading tools, strict host/redirect allowlisting, token revocation guidance, and confirmation for every placement or cancellation. Treat MCP output as untrusted.

• RH_WALLET_API_URL can be overridden despite credentials being attached to every request, while setup runs unpinned pynacl and a key-generation script. Enforce exact HTTPS host allowlisting and pin the dependency and script to a reviewed commit with integrity verification.

• Add trading-risk disclosures covering market-order slippage, volatility, total loss, liquidity, options expiry/assignment, and gateway compromise. Third-party prices, estimates, errors, and signals must never trigger trades automatically.