ahmetenesdur/authenticate-wallet
skills/authenticate-wallet/SKILL.md
Authenticate, manage sessions, and deploy Starknet wallets with StarkFi. Handles email OTP login (two-step), session checks, address display, account deployment, and logout. Use this skill whenever the user wants to sign in, log in, check their session, see their wallet address, deploy their account, or log out — even if they don't say "authenticate" explicitly.
$ install --global
skillsauthnpx skillsauth add ahmetenesdur/starkfi authenticate-walletInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Mar 29, 2026, 12:09 PM36.4s1 file scanned
SKILL.md
- name:
- authenticate-wallet
- description:
- Authenticate, manage sessions, and deploy Starknet wallets with StarkFi. Handles email OTP login (two-step), session checks, address display, account deployment, and logout. Use this skill whenever the user wants to sign in, log in, check their session, see their wallet address, deploy their account, or log out — even if they don't say "authenticate" explicitly.
- license:
- MIT
- compatibility:
- Requires Node.js 18+ and npx.
- version:
- 0.1.0
- author:
- ahmetenesdur
- category:
- auth
Authenticate Wallet
Manage authentication sessions for the StarkFi CLI. StarkFi uses a remote Auth Server with Privy TEE for email-based one-time password (OTP) authentication. A valid session is required before any transactional skill can operate.
Prerequisites
- The StarkFi Auth Server (
starkfi-server) must be running and accessible. - An email address the user has access to (for receiving OTP codes).
Authentication Flow
The login process is a two-step OTP flow:
- Initiate —
auth login <email>sends an OTP code to the email. - Verify —
auth verify <email> <code>completes authentication.
The agent CANNOT guess or auto-fill the OTP code — it must wait for the user to provide it after checking their email.
Rules
- ALWAYS run
npx starkfi@latest statusfirst to check if the user already has an active session. If they do, skip the login flow — just inform them. - After
auth login, you MUST wait for the user to provide their OTP code. Do NOT ask more than once; just say you're waiting. - After
auth verify, you MUST runnpx starkfi@latest statusto confirm the session is active. deployis idempotent — it's safe to run multiple times. It deploys the smart account contract on-chain if not already deployed.- If any other skill reports
Not authenticated, direct the user to this skill.
Commands
# Step 1: Send OTP to email
npx starkfi@latest auth login <email>
# Step 2: Verify OTP code
npx starkfi@latest auth verify <email> <code>
# Check session status
npx starkfi@latest status
# Display wallet address
npx starkfi@latest address
# Deploy smart account on-chain
npx starkfi@latest deploy
# End session
npx starkfi@latest auth logout
Parameters
| Parameter | Type | Description | Required |
| --------- | ------ | ---------------------------- | -------- |
| email | string | User's email address | Yes |
| code | string | One-time password from email | Yes |
Examples
User: "Log me in with [email protected]"
npx starkfi@latest status
# If not authenticated:
npx starkfi@latest auth login [email protected]
# Wait for user to provide OTP code (e.g. "123456")
npx starkfi@latest auth verify [email protected] 123456
npx starkfi@latest status
User: "What's my wallet address?"
npx starkfi@latest address
User: "Deploy my account"
npx starkfi@latest deploy
User: "Log me out"
npx starkfi@latest auth logout
Error Handling
| Error | Action |
| ---------------------- | --------------------------------------------------------------------------- |
| Invalid OTP code | Ask the user to check their email and retry auth verify. |
| Session expired | Restart from auth login. |
| Server unreachable | Ensure starkfi-server is running at the configured URL. |
| Rate limit | Wait 60 seconds before retrying. |
| Deployment failed | Check balance — send ETH/STRK to the address, or enable gasfree mode first. |
| Insufficient balance | For deploy: npx starkfi@latest config set-gasfree on to bypass gas costs. |
Related Skills
- All other skills depend on this skill — if any reports
Not authenticated, use this. - Use
configto enable gasfree mode if the user can't afford deployment gas.
Related Skills
ahmetenesdur/troves
testing
VerifiedTrustedCommunity
Deposit and withdraw from Troves DeFi yield vault strategies on Starknet. View available strategies, check positions, and manage vault deposits. Use this skill when the user mentions Troves, vault, yield vault, DeFi vault, strategy, yield farming, vault deposit, vault withdraw, earning yield through vaults, passive yield strategies, or wants to deposit into or withdraw from a yield strategy — even if they don't say "Troves" explicitly.
2SKILL.mdUpdated Apr 29, 2026
ahmetenesdur/lst
testing
VerifiedTrustedCommunity
Liquid staking via Endur on Starknet — stake STRK to receive xSTRK, redeem xSTRK back to STRK, check positions, and view protocol stats. Yield is embedded in the xSTRK share price (no manual claim needed). Use this skill when the user mentions liquid staking, LST, xSTRK, Endur, liquid staking token, share price, instant staking, tradeable staking position, or wants a staking token they can trade or use in DeFi — even if they don't say "liquid staking" explicitly.
2SKILL.mdUpdated Apr 29, 2026
ahmetenesdur/dca
testing
VerifiedTrustedCommunity
Create, preview, list, and cancel recurring Dollar-Cost Averaging (DCA) buy orders on Starknet via AVNU or Ekubo. Use this skill when the user wants to set up automatic recurring purchases, dollar-cost average into a token, create a DCA order, schedule periodic buys, invest regularly, buy every day/week/month, or manage existing DCA orders. Also trigger when the user says "recurring buy", "scheduled purchase", "buy X of Y every day", or any variation about automated periodic investing — even if they don't use the term "DCA" explicitly.
2SKILL.mdUpdated Apr 10, 2026
ahmetenesdur/confidential
development
VerifiedTrustedCommunity
Manage confidential (private) transfers via Tongo Cash on Starknet — setup, fund, transfer, withdraw, ragequit, rollover using ZK proofs. Use this skill when the user wants to send tokens privately, hide transfer amounts, use zero-knowledge proofs, set up Tongo, fund or withdraw from a confidential account, perform an emergency exit (ragequit), or activate pending balance (rollover). Also trigger when the user says "send privately", "confidential transfer", "hide my transaction", "Tongo Cash", "ZK transfer", or any variation about privacy-preserving transfers — even if they don't use the word "confidential".
2SKILL.mdUpdated Apr 10, 2026