Security audit

Bitwarden Secrets

Security checks for vulnerabilities and agentic risk

Overview

This Bitwarden skill is not clearly malicious, but it handles vault credentials in unsafe and under-disclosed ways that need review before installation.

Install only after reviewing and hardening the bootstrap/export flow. Avoid writing or sourcing plaintext credential export files, avoid running the setup from root unless strictly necessary, and prefer direct bw CLI use or the redacted vw_cli.py commands until the bulk export and shell-sourcing behavior is removed or tightly gated.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/vw_env_export.sh:44
Finding: Command Injection Through Unescaped Vault Values Sourced as Shell Code
Content: View full analysis
/tmp/vw-injected; # ``` This would produce shell source resembling: ```bash export BW_PASSWORD=''; id > /tmp/vw-injected; #' ``` ### Attack Path 1. An attacker gains permission to create or modify one of the selected Vaultwarden items, or causes an attacker-controlled item to be selected through the helper's ambiguous search behavior. 2. The attacker sets the item's password to a value that closes the generated single-quoted assignment and appends a shell command. 3. A vict ...[truncated 901 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/vw_env_export.sh:19
Finding: Fuzzy First-Result Vault Lookup Permits Selection of an Attacker-Controlled Item
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: setup-checklist.md:15
Finding: Predictable Temporary File Stores Plaintext Credentials and Permits Symlink-Based File Overwrite
Content: View full analysis
/tmp/vw_exports.sh` - `source /tmp/vw_exports.sh` ``` ### Technical Analysis The documented workflow redirects the export helper's output into a fixed, predictable path under the shared `/tmp` directory. That output contains the Bitwarden client ID, client secret, and account master password in plaintext shell assignments. The created file's permissions depend on the caller's `umask`; the instructions do not establish a restrictive mode. The file also remains on disk because the checklist does not remove it. Shell redirection opens the destination before running the helper and normally follows symbolic links. A local attacker can pre-create `/tmp/vw_exports.sh` as a symbolic link to a file writable by the victim. If the checklist is followed from the documented root shell, the redirection may truncate and replace a root-writable target with exported credential text. The subsequent `source /tmp/vw_exports.sh` also creates a race between writing and sourcing. Another local process able to replace or modify the path could attempt to make the victim execute attacker-controlled shell commands. ### Attack Path **Plaintext credential disclosure:** 1. A user follows the checklist and redirects the helper output to `/tmp/vw_exports.sh`. 2. The resulting file contains the client ID, client secret, and master password. 3. If the user's `umask` permits broader read access, another local user reads the file. 4. Because no cleanup is specified, the secrets may remain recoverable after the setup operation. **Symlink overwrite:** 1. A local attacker anticipates use of the documented fixed path. 2. The attacker creates `/tmp/vw_exports.sh` as a symbolic link to a target file tha ...[truncated 1330 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: If the skill reveals multiple secret values in plaintext, exports them as environment variables, or performs bulk extraction without the advertised confirmation gate, then the 'safe-by-default' claim is materially false. In the context of a Bitwarden skill, this increases the likelihood of accidental exfiltration through shell history, logs, child processes, or downstream tools that inherit the environment.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: If the skill reveals multiple secret values in plaintext, exports them as environment variables, or performs bulk extraction without the advertised confirmation gate, then the 'safe-by-default' claim is materially false. In the context of a Bitwarden skill, this increases the likelihood of accidental exfiltration through shell history, logs, child processes, or downstream tools that inherit the environment.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.
md
source scripts/vw_bootstrap.sh

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script retrieves three separate secret values from Vaultwarden and emits shell export statements containing the plaintext secrets. This directly conflicts with the stated skill behavior of redacted access by default and revealing only a single secret field with explicit confirmation, increasing the chance of unintended disclosure through terminal output, shell history, logs, or downstream command evaluation.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill declares shell and environment-based operational behavior but does not define an explicit tool scope or permissions boundary. For a secret-handling skill, this omission is risky because consumers cannot easily tell what commands or environment access are intended, making misuse or privilege expansion easier.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The script sources itself into the caller's shell and exports BW_SESSION, BW_CLIENTID, BW_CLIENTSECRET, and BW_PASSWORD into that live environment without an explicit interactive warning or confirmation at the point of loading. This increases the chance of inadvertent secret exposure to later commands, subprocesses, shell history or debugging output, especially because the skill's purpose is secret handling and the bootstrap flow automatically unlocks and refreshes credentials.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/vw_cli.py (reported line 11)May include surrounding context.
python
def run_bw(args): p = subprocess.run(["bw", *args], capture_output=True, text=True) if p.returncode != 0: raise RuntimeError((p.stderr or p.stdout).strip()) return p.stdout.strip()

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The heredoc prints multiple vault secrets as environment variable assignments, creating a bulk exfiltration mechanism that is broader than the skill's documented safe/redacted purpose. Even if intended for local use, exporting several high-value credentials at once expands exposure to shell capture, process inheritance, accidental pasting, and reuse in unrelated contexts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The checklist instructs writing environment exports derived from Bitwarden/Vaultwarden session state to /tmp/vw_exports.sh and then sourcing that file. Temporary locations like /tmp are broadly accessible and can increase the chance of local disclosure, accidental reuse, or recovery of sensitive session material, especially if the script contains BW_SESSION or other secret-bearing variables. In the context of a secrets-access skill, this is more dangerous because the exported data directly enables vault access rather than being an incidental credential.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.