# Sparebank1 Shared

> Runtime contract for the `sb1` CLI (SpareBank 1 personal banking). Covers install, BankID login, secret-storage backends, output formats, global flags, the command map, and error handling. Use this as the foundation before any other sparebank1 skill, or whenever a user asks to check Norwegian bank accounts, balances, or transactions via sb1.

- **Type:** Skill
- **Install:** `agentstack add skill-magnusrodseth-sparebank1-cli-sparebank1-shared`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [magnusrodseth](https://agentstack.voostack.com/s/magnusrodseth)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [magnusrodseth](https://github.com/magnusrodseth)
- **Source:** https://github.com/magnusrodseth/sparebank1-cli/tree/main/skills/sparebank1-shared

## Install

```sh
agentstack add skill-magnusrodseth-sparebank1-cli-sparebank1-shared
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# sparebank1-shared

Foundation skill for the `sb1` CLI, a client for the
[SpareBank 1 personal banking API](https://developer.sparebank1.no). Read this
before using any other `sparebank1` skill.

**This is real money and real bank data. Be conservative.** Never invent account
numbers or amounts; only act on what commands return or what the user states.

## Install & first-time setup

```bash
cargo install sparebank1-cli          # installs the `sb1` binary
```

One-time setup the user must do themselves (requires their BankID):

1. Register a **personal client** app at https://developer.sparebank1.no
2. Set its redirect URI to exactly `http://localhost:12345/callback`
3. Put `CLIENT_ID` / `CLIENT_SECRET` in a `.env` (git-ignored) or env vars
4. `sb1 login`, opens the browser for BankID, stores the token

Do not run `sb1 login` on the user's behalf without asking; it triggers an
interactive BankID flow.

## Authentication & storage

```bash
sb1 status     # logged in? token expiry? which storage backend?
sb1 refresh    # force a token refresh
sb1 logout     # remove the token (add --all to also drop client credentials)
```

Tokens auto-refresh before expiry; the user normally does not re-login between
sessions. Secrets live in one of three backends, chosen by `SB1_STORE`:

| `SB1_STORE` | Where |
|---|---|
| _unset_ / `keychain` | OS keychain (macOS Keychain / Linux keyutils / Windows Credential Manager), **default** |
| `op` / `1password` | 1Password via the `op` CLI (`SB1_OP_VAULT`, `SB1_OP_ACCOUNT`) |
| `file` | `~/.config/sparebank1-cli/*.json` (0600), **plaintext, opt-in** for headless/automation |

If a command reports "not logged in" or the client secret is rejected, tell the
user to run `sb1 login` (the secret has limited validity and may need rotating
in the developer portal). Do not retry in a loop.

## Output & flags

- Default output is human-readable tables (Norwegian amounts: `kr 1 234,56`).
- Add `--json` to **any** command for machine-readable output, always use this
  when parsing programmatically.
- Errors print to stderr with a non-zero exit code.

## Command map

| Command | Purpose | Skill |
|---|---|---|
| `login` / `logout` / `refresh` / `status` / `hello` | auth & health | this skill |
| `accounts` | list accounts | sparebank1-accounts |
| `account  [--details\|--roles]` | one account | sparebank1-accounts |
| `balance ` | balance by account number | sparebank1-accounts |
| `transactions ...` | list/filter/export transactions | sparebank1-accounts |
| `transaction ` | one transaction's details | sparebank1-accounts |
| `export ...` | server-side CSV export | sparebank1-accounts |
| `transfer debit\|creditcard\|pension` | move money | sparebank1-transfers |
| `summary [--months N]` | net worth + cash flow + categories | sparebank1-accounts |

`` for an account accepts its **name** ("Brukskonto"), **key**, or
**number**, the CLI resolves it. Verify with `sb1 accounts` first when unsure.

## Etiquette (API terms)

The bank enforces rate limits and monitors usage. Do **not** add retry/polling
loops or try to bypass limits. On HTTP 429 the CLI reports a `Retry-After`; wait,
don't hammer. Usage is strictly personal; never expose credentials in output.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [magnusrodseth](https://github.com/magnusrodseth)
- **Source:** [magnusrodseth/sparebank1-cli](https://github.com/magnusrodseth/sparebank1-cli)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** yes
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-magnusrodseth-sparebank1-cli-sparebank1-shared
- Seller: https://agentstack.voostack.com/s/magnusrodseth
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.