Bitwarden Lease

• Outcome: Review
• Latest audit: Sep 5, 2026 · 4:26 PM UTC
• Version: 1.0.0

Overview

This skill transparently installs a local Bitwarden session broker, and its sensitive behavior is disclosed and aligned with that purpose.

Install only if you are comfortable with a same-user local broker being able to run allowed Bitwarden CLI commands for up to 24 hours after one unlock. Review the source you install, prefer a pinned commit or release, keep the socket owner-only, and avoid using it on shared or untrusted macOS accounts.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:58
• Finding: Unpinned Remote Skill Installation Creates a Supply-Chain Risk## Vulnerability Details **File Location**: `README.md:58-63` **Vulnerability Type**: Unpinned third-party package and mutable repository installation **Risk Level**: Medium ### Vulnerable Code ```markdown ## Install Install the agent instructions: ```bash npx skills add AntreasAntoniou/bitwarden-lease ``` ``` ### Technical Analysis The documented installation command invokes the `skills` npm package through `npx` without specifying a package version. It also identifies the Skill repository without pinning it to a reviewed commit, release, checksum, or signature. Consequently, the effective installation components can change after this audit. The command may execute a newer version of the npm package and retrieve mutable repository content rather than the exact source that was reviewed. This introduces a supply-chain trust dependency on both the npm package and the remote repository. No malicious remote payload was found in the audited project itself. The vulnerability is that the documented installation procedure does not guarantee that users receive or execute the audited version. ### Attack Path 1. An attacker compromises, takes over, or maliciously updates the npm package used by `npx`, the remote repository, or its default branch. 2. The attacker publishes modified installer behavior, Skill instructions, or scripts. 3. A user follows the documented `npx skills add AntreasAntoniou/bitwarden-lease` command. 4. `npx` resolves and executes the currently available package, which retrieves the mutable repository content. 5. Attacker-controlled content is installed and may later run with the permissions of the invoking user or influence an agent that loads the installed Skill. ### Impact Assessment Exploitation could provide code execution with the privileges of the user running the installation command, subject to the behavior and permissions of the compromised package. A malicious installed Skill could al ...[truncated 515 chars]
• Remediation: ## Remediation Suggestions 1. Pin the npm package to an explicitly reviewed version, for example: ```bash npx --yes skills@REVIEWED_VERSION add ... ``` 2. Pin the Skill source to an immutable commit hash or signed release rather than a mutable default branch. 3. Publish and verify cryptographic checksums or signatures for the downloaded Skill artifact before installation. 4. Prefer installation from a locally downloaded and reviewed artifact where supported. 5. Document the expected commit hash and hashes of security-sensitive scripts, particularly: - `scripts/bitwarden_lease_broker.py` - `scripts/bitwarden_lease_client.py` - `scripts/install_bitwarden_lease_broker.py` 6. Run `scripts/self_test.py` and `scripts/validate_package.py` only after authenticity and integrity verification; these tests do not independently establish source provenance.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill directs installation and operation of local scripts that read files, write files, inspect environment state, invoke shell commands, and interact with network-capable tooling, yet it declares no explicit permissions boundary. That mismatch is a real security issue because agents or reviewers cannot accurately assess or constrain what the skill is allowed to do, especially given its credential-handling role.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The installer writes executable files, creates a shell wrapper in `~/.local/bin`, installs a LaunchAgent plist, and immediately bootstraps and starts it without any explicit user-facing warning or confirmation in the code path. For security-sensitive software that establishes persistence and handles credential-access workflows, silent installation of a background agent increases the risk of users enabling long-lived local attack surface without informed consent.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

state = self.unlock()
        if state["status"] != "unlocked":
            return {"exit_code": 77, "stderr": str(state.get("error", "vault locked")), "stdout": ""}
        environment = os.environ.copy()
        environment["BW_SESSION"] = self._session or ""
        try:
            completed = subprocess.run(

• Confidence: 86% confidence
• Finding: Copying the entire parent environment into the child process can leak unrelated secrets and lets attacker-controlled environment variables influence execution of a highly sensitive credential broker. In this skill context, the broker handles Bitwarden session material, so inheriting `PATH`, dynamic loader settings, or other sensitive variables increases the blast radius if the process is launched in a tainted environment.

Unvalidated Output Injection

High

• Category: Output Handling

Content

environment = os.environ.copy()
        environment["BW_SESSION"] = self._session or ""
        try:
            completed = subprocess.run(
                ["bw", *argv],
                env=environment,
                capture_output=True,

• Confidence: 71% confidence
• Finding: Although the code avoids shell injection, it forwards largely unvalidated user-supplied arguments to a privileged Bitwarden session context. Because the broker is specifically designed to let local clients consume secrets without direct access to `BW_SESSION`, weak per-subcommand argument validation can let a caller use allowed `bw` operations to enumerate or retrieve vault data beyond what the caller should access.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/self_test.py:30