BofAI · Will-Guan · Apr 1, 2026 · Mar 25, 2026 · Mar 25, 2026 · Mar 25, 2026
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
@@ -6,13 +6,15 @@ on:
       - main
       - master
       - update-mcp-server
+      - ai-bankofai-patch-1
     tags:
       - 'test'
   pull_request:
     branches:
       - main
       - master
       - update-mcp-server
+      - ai-bankofai-patch-1
   workflow_dispatch: # Intentionally unrestricted — allows manual builds from any branch for flexibility
 
 env:

diff --git a/docs/Agent-Wallet/Developer/CLI-Reference.md b/docs/Agent-Wallet/Developer/CLI-Reference.md
@@ -28,7 +28,11 @@ The interactive wizard may offer a `raw_secret` option. This type stores your pr
 ```bash
 agent-wallet start -p Abc12345!
 ```
-Password requirements: at least 8 characters, including uppercase, lowercase, numbers, and special characters.
+Password requirements: at least 8 characters, including uppercase, lowercase, numbers, and special characters. If the password doesn't meet these requirements, the CLI will keep prompting you to enter a stronger one until it passes validation.
+
+When creating a new password interactively, you must enter it twice for confirmation. If the two entries don't match, the CLI will ask you to try again.
+
+**Default wallet IDs:** If you don't specify a wallet ID, the system defaults to `default_secure` for `local_secure` wallets and `default_raw` for `raw_secret` wallets.
 
 :::caution Shell history risk
 Passing `-p` inline records the password in your terminal's history file. For production wallets, prefer interactive mode (`agent-wallet start` without `-p`) or set `AGENT_WALLET_PASSWORD` as an environment variable — see [Non-Interactive Execution](#non-interactive-execution-for-automation--background-services).
@@ -48,6 +52,10 @@ agent-wallet start -p Abc12345! -m "word1 word2 word3 ..."
 
 Every `sign` subcommand requires `--network` / `-n` to specify the chain.
 
+:::info Password retry behavior
+When signing with a `local_secure` wallet, the CLI will prompt for the master password if it's not provided via `-p` or `AGENT_WALLET_PASSWORD`. If you enter the wrong password, you get **2 retry attempts** (3 total) before the command fails with "Wrong password. 3 attempts failed."
+:::
+
 **Sign a message:**
 ```bash
 agent-wallet sign msg "Hello" -n tron

diff --git a/docs/Agent-Wallet/Developer/SDK-Guide.md b/docs/Agent-Wallet/Developer/SDK-Guide.md
@@ -517,10 +517,14 @@ WalletError
 ├── DecryptionError          # Wrong password or corrupted key file
 ├── SigningError              # Signing operation failed
 ├── NetworkError             # Network identifier mismatch
-├── InsufficientBalanceError # Insufficient balance (thrown by caller)
+├── InsufficientBalanceError # Insufficient balance
 └── UnsupportedOperationError # Operation not supported by this wallet type
 ```
 
+:::tip About InsufficientBalanceError
+`InsufficientBalanceError` is **not** thrown by the SDK itself — Agent-wallet is a sign-only tool and does not check balances. This error type is provided as a convenience for your application code to throw when you detect insufficient funds before initiating a transaction.
+:::
+
 ---
 
 ## Next Steps

diff --git a/docs/Agent-Wallet/QuickStart.md b/docs/Agent-Wallet/QuickStart.md
@@ -66,22 +66,22 @@ The system will guide you through initializing your **Agent-wallet wallet**. The
 
 ```
 ? Quick start type: local_secure  — Encrypted key stored locally (recommended)
-Wallet ID (e.g. my_wallet_1) (default):
+Wallet ID (e.g. my_wallet_1) (default_secure):
 
 Wallet initialized!
 ? Import source: generate  — Generate a new random private key
 
 Wallets:
-┌───────────┬──────────────┐
-│ Wallet ID │ Type         │
-├───────────┼──────────────┤
-│ default   │ local_secure │
-└───────────┴──────────────┘
+┌────────────────┬──────────────┐
+│ Wallet ID      │ Type         │
+├────────────────┼──────────────┤
+│ default_secure │ local_secure │
+└────────────────┴──────────────┘
 
 Your master password: <your-unique-password-will-appear-here>
    Save this password! You'll need it for signing and other operations.
 
-Active wallet: default
+Active wallet: default_secure
 ```
 
 :::caution Master password = the only key to all your assets

diff --git a/docs/McpServer-Skills/MCP/TRONMCPServer/LocalPrivatizedDeployment.md b/docs/McpServer-Skills/MCP/TRONMCPServer/LocalPrivatizedDeployment.md
@@ -189,7 +189,7 @@ If everything is working, the AI will call the `get_wallet_address` tool and ret
 You can also try a testnet transfer (make sure you have test TRX on Nile):
 
 ```
-Transfer 1 TRX to address TNPeeaaFB7K9cmo4uQpcU32zGK8G1NYqeL on the Nile testnet
+Transfer 1 TRX to address TNPee...xxxxx on the Nile testnet
 ```
 
 :::info Getting Test TRX

diff --git a/docs/McpServer-Skills/SKILLS/BANKOFAISkill.md b/docs/McpServer-Skills/SKILLS/BANKOFAISkill.md
@@ -19,6 +19,8 @@ BANK OF AI SKILLS can operate on **real on-chain assets**. Blockchain transactio
 | **sunswap** | Check prices, get quotes, swap tokens, manage liquidity pools | Read-only: none. Trading: wallet credentials |
 | **sunperp-skill** | Market data, open/close positions, withdrawals | Market data: none. Trading: SunPerp API keys |
 | **tronscan-skill** | Look up accounts, transactions, tokens, blocks, network stats | Recommended: TronScan API key (may throttle without one) |
+| **trc20-toolkit-skill** | Transfer tokens, check balances, manage approvals for any TRC20 token | Read-only: none. Transfers/approvals: wallet credentials |
+| **multisig-permissions** | Multi-sig permission setup, key management, co-signed proposals | Wallet credentials (owner key for permission changes) |
 | **x402-payment** | On-chain "pay-first" auto-settlement | Wallet credentials |
 | **recharge-skill** | Balance, order history, account top-up | BANK OF AI API key |
 
@@ -60,7 +62,7 @@ Head over to **[Quick Start](./QuickStart.md)** — it takes about 1 minute. Com
 
 ---
 
-## sunswap — Swap Tokens, Check Prices, Manage Pools {#sunswap}
+## sunswap {#sunswap}
 
 Want to swap tokens, check rates, or manage liquidity on SunSwap? Just tell the AI.
 
@@ -92,7 +94,7 @@ Want to swap tokens, check rates, or manage liquidity on SunSwap? Just tell the
 
 ---
 
-## sunperp-skill — Perpetual Contract Trading {#sunperp-skill}
+## sunperp-skill {#sunperp-skill}
 
 Want to trade contracts? This skill handles market data, opening/closing positions, stop-loss, and withdrawals. Built-in safety: max 20x leverage, mandatory stop-loss — if losses exceed 5%, the AI automatically closes your position to prevent liquidation.
 
@@ -122,11 +124,11 @@ Want to trade contracts? This skill handles market data, opening/closing positio
 
 ---
 
-## tronscan-skill — On-Chain Data Detective {#tronscan-skill}
+## tronscan-skill {#tronscan-skill}
 
 Want to know what's happening on-chain? This skill looks up accounts, transactions, tokens, blocks, and network stats. **Pure read-only, completely safe, costs nothing, needs no credentials.** The perfect first skill to get started.
 
-> Look up the full account info and holdings for address TDqSquXBgUCLYvYC4XZgrprLK589dkhSCf.
+> Look up the full account info and holdings for address TDqSq...xxxxx.
 
 > Show me the details of this transaction: abc123...
 
@@ -146,7 +148,71 @@ Want to know what's happening on-chain? This skill looks up accounts, transactio
 
 ---
 
-## x402-payment — On-Chain "Pay-First" Auto-Settlement {#x402-payment}
+## trc20-toolkit-skill {#trc20-toolkit-skill}
+
+Need to check balances, transfer tokens, or manage approvals for any TRC20 token? This skill handles it all — supports common tokens by symbol (USDT, USDD, SUN, JST, BTT, WIN, etc.) and any TRC20 token by contract address.
+
+**Completely safe — looking only, no spending:**
+
+> Show my USDT balance.
+
+> Check my USDT, USDD, and SUN balances all at once.
+
+> What's the token info (name, symbol, decimals, total supply) for USDT?
+
+> Check the current USDT approval allowance for spender address TSpender...
+
+**Requires your confirmation (AI shows the bill first):**
+
+> Transfer 10 USDT to TRecipientAddress on the Nile testnet.
+
+> Approve 100 USDT for spender TSpenderAddress.
+
+**Real-world scenarios:**
+
+> Quick portfolio check? Try: "Show my balances for USDT, USDD, SUN, JST, and BTT."
+
+> Sending tokens to a friend? Try: "Transfer 50 USDT to TXX...."
+
+> Preparing for a DeFi operation? Try: "Approve 200 USDT for the SunSwap router, then check the allowance."
+
+---
+
+## multisig-permissions {#multisig-permissions}
+
+Want to add multi-signature protection to your TRON account? This skill manages TRON's native three-tier permission model (Owner, Active, Witness) — configure keys, set thresholds, scope operation permissions, and coordinate multi-party co-signing. Perfect for team wallets or restricting your AI agent to DeFi-only operations.
+
+**Completely safe — looking only, no spending:**
+
+> Check my account's current permission setup.
+
+> Check the permission configuration for address TXk8r...xxxxx.
+
+> List all pending multi-sig proposals.
+
+**Requires your confirmation:**
+
+> Set up a 2-of-3 multi-sig on my account's owner permission with these three keys.
+
+> Restrict the active permission so the AI agent can only call smart contracts (no direct TRX transfers).
+
+> Propose a transfer of 500 USDT to TRecipient and wait for the co-signer to approve.
+
+**Real-world scenarios:**
+
+> Want team approval for large transfers? Try: "Set up 2-of-3 multi-sig, then propose a 10,000 TRX transfer to TVendor... with memo 'Q1 budget'."
+
+> Want to sandbox your AI agent? Try: "Use the agent-restricted template — let the AI only call smart contracts, but require 2 human keys for permission changes."
+
+> Co-signing a pending proposal? Try: "Review all pending proposals and co-sign proposal prop_xxx."
+
+:::tip Templates make it easy
+You don't need to configure every key and threshold manually. Built-in templates like `basic-2of3`, `agent-restricted`, `team-tiered`, and `weighted-authority` handle the common setups — just provide the key addresses.
+:::
+
+---
+
+## x402-payment {#x402-payment}
 
 Some APIs and AI agents require on-chain payment before use. This skill uses the x402 protocol to automatically complete "pay first, then receive" on-chain settlement — the AI detects the charge, completes the on-chain payment, gets the result, and reports back. It always asks for your confirmation before paying.
 
@@ -156,7 +222,7 @@ Some APIs and AI agents require on-chain payment before use. This skill uses the
 
 ---
 
-## recharge-skill — BANK OF AI Account Management {#recharge-skill}
+## recharge-skill {#recharge-skill}
 
 Check your balance, view order history, or top up your account.
 

diff --git a/docs/McpServer-Skills/SKILLS/Faq.md b/docs/McpServer-Skills/SKILLS/Faq.md
@@ -40,7 +40,7 @@ Run this in your terminal:
 ls ~/.openclaw/skills
 ```
 
-You should see directory names like `sunswap`, `sunperp-skill`, `tronscan-skill`, `x402-payment`, `recharge-skill`.
+You should see directory names like `sunswap`, `sunperp-skill`, `tronscan-skill`, `trc20-toolkit-skill`, `multisig-permissions`, `x402-payment`, `recharge-skill`.
 
 Then verify in your AI chat:
 

diff --git a/docs/McpServer-Skills/SKILLS/Intro.md b/docs/McpServer-Skills/SKILLS/Intro.md
@@ -57,47 +57,63 @@ No. Skills use an **on-demand, lightweight architecture** — the AI only loads
 
 ## What Can Skills Do for You?
 
-Five core skills covering the most common scenarios in the TRON ecosystem. Each one comes with a ready-to-use sample prompt — copy it into your AI chat and hit enter to try it out.
+Seven core skills covering the most common scenarios in the TRON ecosystem. Each one comes with a ready-to-use sample prompt — copy it into your AI chat and hit enter to try it out.
 
 ### 💱 Execute DEX Trades
 
 Check prices, compare rates, even swap tokens in one go.
 
 > 🗣️ "How much TRX can I get for 100 USDT on SunSwap right now?"
 
-💡 For more advanced features, see: [**sunswap** (DEX Trading Guide)](./BANKOFAISkill.md#sunswap)
+💡 For more advanced features, see: [**sunswap**](./BANKOFAISkill.md#sunswap)
 
 ### 📈 Trade Perpetual Contracts
 
 View market data, open and close positions on SunPerp. Built-in safety lock: max 20x leverage, mandatory stop-loss on every position — keeps you from blowing up your account.
 
 > 🗣️ "What's BTC's funding rate right now? Open a 5x long position with a 5% stop-loss."
 
-💡 For more parameter settings, see: [**sunperp-skill** (Perpetual Contract Safety Officer)](./BANKOFAISkill.md#sunperp-skill)
+💡 For more parameter settings, see: [**sunperp-skill**](./BANKOFAISkill.md#sunperp-skill)
 
 ### 🕵️ Query On-Chain Data
 
 Look up accounts, transactions, and check if a new token is legit. Pure read-only, completely safe, costs nothing.
 
 > 🗣️ "Check the holder distribution for that new token — is it controlled by a whale?"
 
-💡 For more query dimensions, see: [**tronscan-skill** (On-Chain Data Detective)](./BANKOFAISkill.md#tronscan-skill)
+💡 For more query dimensions, see: [**tronscan-skill**](./BANKOFAISkill.md#tronscan-skill)
+
+### 💸 Transfer & Manage TRC20 Tokens
+
+Check balances, transfer tokens, manage approvals for any TRC20 token — USDT, USDD, SUN, and more. Supports batch balance checks and symbol-based lookups.
+
+> 🗣️ "Check my USDT, USDD, and SUN balances. Then transfer 10 USDT to TRecipientAddress."
+
+💡 For more token operations, see: [**trc20-toolkit-skill**](./BANKOFAISkill.md#trc20-toolkit-skill)
+
+### 🔐 Multi-Sig & Account Permissions
+
+Set up multi-signature security for your TRON account — configure keys, thresholds, and co-sign transactions. Perfect for teams or for restricting your AI agent to DeFi-only operations.
+
+> 🗣️ "Check my account's current permission setup. Then set up a 2-of-3 multi-sig on owner permission."
+
+💡 For permission templates and multi-sig workflows, see: [**multisig-permissions**](./BANKOFAISkill.md#multisig-permissions)
 
 ### ☕ Auto-Settle On-Chain Paid Services
 
 When the AI needs to call a paid on-chain service or data API, it uses the x402 protocol to automatically complete "pay first, then receive" on-chain settlement — no manual QR scanning or wallet switching needed.
 
 > 🗣️ "Use the x402 protocol to call this paid agent endpoint: https://api.example.com" (replace with the actual paid endpoint URL you want to call)
 
-💡 For payment and authorization details, see: [**x402-payment** (On-Chain Auto-Settlement)](./BANKOFAISkill.md#x402-payment)
+💡 For payment and authorization details, see: [**x402-payment**](./BANKOFAISkill.md#x402-payment)
 
 ### 🏦 Manage BANK OF AI Account
 
 Check your BANK OF AI balance and top up with a single sentence.
 
 > 🗣️ "How much balance do I have? Go ahead and recharge 5 USDT."
 
-💡 For top-up and withdrawal rules, see: [**recharge-skill** (Account Manager)](./BANKOFAISkill.md#recharge-skill)
+💡 For top-up and withdrawal rules, see: [**recharge-skill**](./BANKOFAISkill.md#recharge-skill)
 
 ---
 

diff --git a/docs/McpServer-Skills/SKILLS/QuickStart.md b/docs/McpServer-Skills/SKILLS/QuickStart.md
@@ -47,12 +47,12 @@ Ok to proceed? (y) y
 The installer automatically fetches all available Skills from the repo and lists them for selection. Press **Space** to toggle each one — we recommend selecting all:
 
 ```
-◇  Found 6 skills
+◇  Found 7 skills
 │
 ◇  Select skills to install (space to toggle)
 │  Multi-Sig & Account Permissions, recharge-skill,
 │  SunPerp Perpetual Futures Trading, SunSwap DEX Trading,
-│  TronScan Data Lookup, x402-payment
+│  TRC20 Token Toolkit, TronScan Data Lookup, x402-payment
 ```
 
 :::tip Select all
@@ -91,6 +91,7 @@ The installer runs a security scan on each Skill and shows the results. Review t
 │  recharge-skill                    --     --       --    │
 │  SunPerp Perpetual Futures Trading --     --       --    │
 │  SunSwap DEX Trading               --     --       --    │
+│  TRC20 Token Toolkit               --     --       --    │
 │  TronScan Data Lookup              --     --       --    │
 │  x402-payment                      Med    1 alert  Med   │
 │                                                          │
@@ -105,12 +106,13 @@ The installer runs a security scan on each Skill and shows the results. Review t
 When you see output like this, all Skills have been successfully installed to your selected AI tools:
 
 ```
-◇  Installed 6 skills ────────────────────────╮
+◇  Installed 7 skills ────────────────────────╮
 │                                             │
 │  ✓ Multi-Sig & Account Permissions (copied) │
 │  ✓ recharge-skill (copied)                  │
 │  ✓ SunPerp Perpetual Futures Trading (copied)│
 │  ✓ SunSwap DEX Trading (copied)             │
+│  ✓ TRC20 Token Toolkit (copied)             │
 │  ✓ TronScan Data Lookup (copied)            │
 │  ✓ x402-payment (copied)                    │
 │                                             │