BroSettlement Agent Skills turn wallet setup into a guarded workflow
BroSettlement Agent Skills help Codex, Claude Code, Cursor, or another skills-compatible AI agent guide a developer through BroSettlement onboarding, API discovery, signed requests, WebSocket events, and recovery planning. The point is not to let the model hold secrets. The point is to give the agent structured knowledge and guarded tooling while private keys, Co-Signer material, MPC shares, and recovery files stay in protected infrastructure.
For teams building AI-agent wallets, this matters because setup instructions are now part of the security boundary. A vague prompt like "create me a wallet" can lead to unsafe shortcuts. A skills-based workflow can instead inspect documentation, ask for the correct local folder, guide API-key creation, check Co-Signer health, initialize MPC only after readiness checks, and create a first testnet wallet without exposing secrets in chat.
Short answer
To use BroSettlement with an AI coding agent, install all three BroSettlement Agent Skills from the public repository, inspect the SKILL.md files and scripts, verify the skills are discoverable, then activate $brosettlement-onboarding. A safe setup should keep credentials out of model context, use scoped Ed25519 API keys, run the customer-hosted Co-Signer outside chat, complete MPC/DKG readiness checks, create a testnet wallet first, and track actions through API responses, WebSocket events, and the ledger.
Where the skills fit
The public repository contains three sibling skills. They are related, but they should not be treated as one unrestricted automation package.
| Skill | Use it for | What the agent should produce |
|---|---|---|
| BroSettlement Onboarding | A guided setup from organization access to Co-Signer, MPC, and first wallet | A running Co-Signer, initialized MPC/DKG, and a first testnet wallet |
| BroSettlement API | Current Swagger inspection, signed REST requests, WebSocket listening, and API troubleshooting | Discoverable commands, signed requests, event listeners, and verified API responses |
| BroSettlement Disaster Recovery | A controlled break-glass Share B + Share C recovery ceremony | One approved recovery transfer path, isolated from normal onboarding |
This separation is important. Onboarding can use the API skill for signed calls and remote status checks. Disaster recovery remains a separate, explicit procedure for situations where normal A+B signing is unavailable. It should not be activated casually during ordinary wallet setup.
Installation checklist for Codex, Claude Code, or Cursor
Use a checklist before asking an agent to install anything:
- Review the repository first. Open the BroSettlement Agent Skills GitHub repository and inspect the three
SKILL.mdfiles, installer, scripts, security policy, and release history. - Confirm skill support. Codex, Claude Code, Cursor, or another agent must support skills or an equivalent project-instruction format.
- Choose the skills directory. The agent should ask which directory your environment uses and should not guess or overwrite existing skills.
- Install sibling folders.
brosettlement-onboarding,brosettlement-api, andbrosettlement-disaster-recoveryshould sit side by side. - Reload skill discovery. Restart or refresh the agent so it can find the new skills.
- Verify availability. Ask the agent to confirm that all three skills are available before starting BroSettlement setup.
- Start onboarding intentionally. Activate
$brosettlement-onboardingonly after installation is verified.
A practical installation prompt is already documented in the Agent Skills API reference. The useful part is its guardrail: install and verify the skills first; do not run BroSettlement setup or request credentials during installation.
Video walkthrough
Use this video alongside the checklist when you want a visual pass through the Agent Skills setup flow. Watch it before handing an AI agent access to your local skills directory, then return to the checklist above and verify each installation step explicitly.
<iframe width="100%" style="aspect-ratio: 16 / 9;" src="https://www.youtube.com/embed/joU3qlzrJvY" title="BroSettlement Agent Skills walkthrough" frameborder="0" allow="autoplay; encrypted-media; picture-in-picture" allowfullscreen></iframe>
If the embed does not load, open the walkthrough on YouTube.
What the agent should never receive
Agent Skills do not change the basic security rule: do not paste secrets into the model. The agent may guide the process, but it should not become the place where key material lives.
| Material | Safe handling |
|---|---|
| Ed25519 API private key | Generate and store locally or in an approved secret manager; never paste it into chat |
| Co-Signer key material | Keep it in the customer-controlled Co-Signer environment |
| MPC shares | Store encrypted shares in protected persistent storage |
| Recovery share files | Keep them separated and use only in a controlled recovery ceremony |
| API key IDs and public values | Share only when needed for configuration or debugging |
The model can read sanitized IDs, paths, resource names, and redacted plans. It should not see passwords, JWTs, TOTP codes, private keys, recovery files, full signed WebSocket URLs, or raw secret values.
Operating model after installation
After installation, the onboarding flow should be boring in the best possible way. The agent checks prerequisites, asks for the Co-Signer folder, helps generate Ed25519 material without overwriting existing keys, gives manual Console instructions for scoped API-key creation, installs and starts the Co-Signer, verifies local and remote health, initializes MPC/DKG through the API skill, and creates a first testnet ledger account and wallet.
For API work, the BroSettlement API skill should inspect the live Swagger contract before building requests. It can list wallet-related commands, explain schemas, prepare signed REST calls, listen to WebSocket events, and help reconcile responses with the BroSettlement operating ledger. That is different from a static tutorial: the agent works from the current API contract.
For product teams, the safe pattern is:
- Agent reads context and proposes the next setup step.
- User confirms actions that create or change resources.
- Local tooling signs requests without revealing the private key.
- Co-Signer participates only after its health and policy checks pass.
- WebSocket events and ledger records prove what happened.
Risk controls before a real wallet flow
Before moving from testnet to real assets, review the controls that should already be visible:
- scoped API permissions for onboarding and wallet operations;
- protected runtime location for API keys and Co-Signer storage;
- Co-Signer health checks and remote status visibility;
- MPC/DKG status verification before wallet operations;
- idempotency on mutation requests;
- WebSocket event handling and replay strategy;
- ledger records for deposits, withdrawals, failures, and corrections;
- a documented recovery procedure that is not mixed into normal onboarding.
BroSettlement is not a KYC/KYB provider, Travel Rule provider, exchange, OTC desk, or consumer wallet. Your organization remains responsible for regulatory analysis, customer due diligence, monitoring, reporting, and operating policy.
How BroLabel fits
BroSettlement is the wallet, ledger, signing, and settlement layer behind the product experience. BroLabel AI Agents explain how an agent can help with wallet operations without becoming the signing authority. Agent Skills connect those two ideas: the agent gets structured workflows, while BroSettlement keeps wallet operations tied to scoped API access, customer-hosted Co-Signer checks, MPC signing, WebSocket events, and ledger records.
The best next step is simple: install the skills, verify them, and use $brosettlement-onboarding to create a testnet wallet before touching production funds.
FAQ
Can I use these skills in Codex, Claude Code, or Cursor?
Yes, if the agent supports the open Agent Skills SKILL.md format or an equivalent way to load project instructions, scripts, and references. If automatic installation is not supported, the agent should tell you the exact destination directory and next action instead of claiming success.
Do Agent Skills give the AI model access to private keys?
No. The documented workflow keeps private keys, Co-Signer material, MPC shares, and recovery files outside chat. The agent can guide setup and call guarded local tooling, but secrets should stay in your protected runtime or secret manager.
Which skill should I activate first?
Use $brosettlement-onboarding for a new setup. It can rely on $brosettlement-api for signed API calls and status checks. Activate $brosettlement-disaster-recovery only for an explicitly approved recovery ceremony.
Should the first wallet be testnet or production?
Start with testnet. The first flow should prove API access, Co-Signer readiness, MPC/DKG status, wallet creation, event handling, and ledger visibility before any production funds are involved.