ahmetenesdur/confidential
skills/confidential/SKILL.md
Manage confidential (private) transfers via Tongo Cash on Starknet — setup, fund, transfer, withdraw, ragequit, rollover using ZK proofs. Use this skill when the user wants to send tokens privately, hide transfer amounts, use zero-knowledge proofs, set up Tongo, fund or withdraw from a confidential account, perform an emergency exit (ragequit), or activate pending balance (rollover). Also trigger when the user says "send privately", "confidential transfer", "hide my transaction", "Tongo Cash", "ZK transfer", or any variation about privacy-preserving transfers — even if they don't use the word "confidential".
$ install --global
skillsauthnpx skillsauth add ahmetenesdur/starkfi confidentialInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 24, 2026, 8:42 PM1.9s1 file scanned
SKILL.md
- name:
- confidential
- description:
- Manage confidential (private) transfers via Tongo Cash on Starknet — setup, fund, transfer, withdraw, ragequit, rollover using ZK proofs. Use this skill when the user wants to send tokens privately, hide transfer amounts, use zero-knowledge proofs, set up Tongo, fund or withdraw from a confidential account, perform an emergency exit (ragequit), or activate pending balance (rollover). Also trigger when the user says "send privately", "confidential transfer", "hide my transaction", "Tongo Cash", "ZK transfer", or any variation about privacy-preserving transfers — even if they don't use the word "confidential".
- license:
- MIT
- compatibility:
- Requires Node.js 18+ and npx.
- version:
- 0.1.0
- author:
- ahmetenesdur
- category:
- transaction
Confidential Transfers (Tongo Cash)
Privacy-preserving token transfers using ZK proofs on Starknet. Amounts are hidden on-chain; recipients are identified by elliptic curve public keys, not Starknet addresses.
Prerequisites
- Active session required. If not authenticated, run
authenticate-walletskill first. - Tongo credentials configured (
conf-setup). Must be done once before any other confidential command. - Sufficient public token balance for
conf-fundoperations.
Rules
- BEFORE any confidential operation, run
npx starkfi@latest statusto verify authentication. conf-setupMUST be called before any other confidential command. It only needs to run once.- BEFORE
conf-fund, checkbalanceto verify sufficient public token balance. - BEFORE
conf-transferorconf-withdraw, checkconf-balanceto verify sufficient active balance. - After the recipient receives a transfer, remind them to run
conf-rolloverto activate pending balance. conf-ragequitis a DESTRUCTIVE operation — it empties the entire confidential balance. Always warn the user and get explicit confirmation.- AFTER any transactional operation (
conf-fund,conf-transfer,conf-withdraw,conf-ragequit,conf-rollover), verify withtx-status. - The Tongo private key is stored locally at
~/.local/share/starkfi/confidential.jsonwith strict0o600permissions and is never sent to the network.
Setup (One-Time)
The user first needs a Tongo Private Key. They can generate or export this key through the Tongo Cash or refer to the Tongo Documentation.
npx starkfi@latest conf-setup --key <TONGO_PRIVATE_KEY> --contract 0x1234…
Commands
Check Balance
npx starkfi@latest conf-balance [--json]
Returns: active balance, pending balance, nonce, Tongo address.
Fund Confidential Account
Move public ERC-20 tokens into a private confidential balance.
npx starkfi@latest conf-fund <amount> [--token <symbol>] [--simulate] [--json]
Transfer Confidentially
Send tokens privately to another Tongo account. Recipient is identified by their public key coordinates (x, y).
npx starkfi@latest conf-transfer <amount> --recipient-x <x> --recipient-y <y> [--token <symbol>] [--simulate] [--json]
Withdraw to Public
Convert private balance back to public ERC-20 tokens.
npx starkfi@latest conf-withdraw <amount> [--to <address>] [--token <symbol>] [--simulate] [--json]
Ragequit (Emergency Exit)
Withdraw the entire confidential balance to a public address immediately.
npx starkfi@latest conf-ragequit [--to <address>] [--json]
Rollover (Activate Pending)
Received transfers start as "pending" and must be rolled over to become spendable.
npx starkfi@latest conf-rollover [--json]
Parameters
| Parameter | Type | Description | Required |
| --------------- | ------ | ---------------------------------- | -------------- |
| amount | number | Amount for fund/transfer/withdraw | Yes |
| --key | string | Tongo private key (setup only) | Yes (setup) |
| --contract | string | Tongo contract address | Yes (setup) |
| --recipient-x | string | Recipient public key X coordinate | Yes (transfer) |
| --recipient-y | string | Recipient public key Y coordinate | Yes (transfer) |
| --token | string | Token symbol (default: USDC) | No |
| --to | string | Recipient Starknet address | No |
| --simulate | flag | Estimate fees without broadcasting | No |
| --json | flag | Output as JSON | No |
Examples
User: "Set up my Tongo account"
npx starkfi@latest conf-setup --key <KEY> --contract 0x1234…
User: "Fund 100 USDC into my confidential account"
npx starkfi@latest status
npx starkfi@latest balance --token USDC
npx starkfi@latest conf-fund 100 --token USDC --simulate
npx starkfi@latest conf-fund 100 --token USDC
npx starkfi@latest tx-status <hash>
User: "Send 50 privately to this public key"
npx starkfi@latest conf-balance
npx starkfi@latest conf-transfer 50 --recipient-x 0xABC --recipient-y 0xDEF --simulate
npx starkfi@latest conf-transfer 50 --recipient-x 0xABC --recipient-y 0xDEF
npx starkfi@latest tx-status <hash>
User: "Withdraw 100 from my confidential account"
npx starkfi@latest conf-balance
npx starkfi@latest conf-withdraw 100 --simulate
npx starkfi@latest conf-withdraw 100
npx starkfi@latest tx-status <hash>
User: "Emergency withdraw everything"
# WARN: This empties the entire confidential balance
npx starkfi@latest conf-ragequit
npx starkfi@latest tx-status <hash>
User: "Activate my pending balance"
npx starkfi@latest conf-rollover
npx starkfi@latest tx-status <hash>
Error Handling
| Error | Action |
| ----------------------------- | ----------------------------------------------------------- |
| CONFIDENTIAL_NOT_CONFIGURED | Run conf-setup with valid Tongo key and contract address. |
| CONFIDENTIAL_FAILED | Check balance, credentials, and retry. |
| Insufficient balance | Check conf-balance for active balance before operations. |
| Not authenticated | Run authenticate-wallet skill first. |
Related Skills
- Use
authenticate-walletto ensure an active session before confidential operations. - Use
balanceto verify public token balance before funding. - Use
sendfor standard (non-private) token transfers. - Use
configto set a custom RPC if experiencing rate limits.
Related Skills
ahmetenesdur/troves
testing
VerifiedTrustedCommunity
Deposit and withdraw from Troves DeFi yield vault strategies on Starknet. View available strategies, check positions, and manage vault deposits. Use this skill when the user mentions Troves, vault, yield vault, DeFi vault, strategy, yield farming, vault deposit, vault withdraw, earning yield through vaults, passive yield strategies, or wants to deposit into or withdraw from a yield strategy — even if they don't say "Troves" explicitly.
2SKILL.mdUpdated Apr 29, 2026
ahmetenesdur/lst
testing
VerifiedTrustedCommunity
Liquid staking via Endur on Starknet — stake STRK to receive xSTRK, redeem xSTRK back to STRK, check positions, and view protocol stats. Yield is embedded in the xSTRK share price (no manual claim needed). Use this skill when the user mentions liquid staking, LST, xSTRK, Endur, liquid staking token, share price, instant staking, tradeable staking position, or wants a staking token they can trade or use in DeFi — even if they don't say "liquid staking" explicitly.
2SKILL.mdUpdated Apr 29, 2026
ahmetenesdur/dca
testing
VerifiedTrustedCommunity
Create, preview, list, and cancel recurring Dollar-Cost Averaging (DCA) buy orders on Starknet via AVNU or Ekubo. Use this skill when the user wants to set up automatic recurring purchases, dollar-cost average into a token, create a DCA order, schedule periodic buys, invest regularly, buy every day/week/month, or manage existing DCA orders. Also trigger when the user says "recurring buy", "scheduled purchase", "buy X of Y every day", or any variation about automated periodic investing — even if they don't use the term "DCA" explicitly.
2SKILL.mdUpdated Apr 10, 2026
ahmetenesdur/trade
testing
VerifiedTrustedCommunity
Swap tokens on Starknet via Fibrous DEX aggregator. Supports per-provider selection (avnu, ekubo, or auto to race all). Use this skill when the user wants to swap, exchange, trade, convert, buy, or sell one token for another on Starknet. Also use when the user asks about token prices, exchange rates, DEX routing, best swap route, or wants to check how much they would receive for a given amount — even if they don't explicitly say "swap".
2SKILL.mdUpdated Mar 27, 2026