Bitwarden Secrets Manager CLI

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:36 AM UTC
• Version: 0.1.0

Overview

This Bitwarden skill is mostly coherent, but it can automatically download and execute a mutable remote installer while handling highly sensitive secrets.

Review this skill before installing. It is not showing deception or exfiltration, but it operates on real Bitwarden secrets and can run a remote installer automatically if bws is missing. Prefer installing bws yourself from a verified source first, use least-privilege machine-account tokens, avoid global/noninteractive installation unless needed, and do not let agents create or edit highly sensitive secret values unless you accept the command-argument exposure risk.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/ensure-bws.sh:31

Finding

Unverified Remote Installer Download and Execution

Content

View full analysis

Vulnerability Details

File Location: scripts/ensure-bws.sh:31-32
Vulnerability Type: Remote code downloaded from a mutable URL and executed without local integrity verification
Risk Level: High

Vulnerable Code

sh

curl -fsSL https://bws.bitwarden.com/install -o "$installer"
sh "$installer"

The workflow in SKILL.md:10-11 directs the agent to run this installation helper at the beginning of every task. The corresponding Windows guidance also recommends direct remote execution:

powershell

iwr https://bws.bitwarden.com/install | iex

Technical Analysis

When bws is not present on PATH, the helper downloads an installer from a mutable remote URL and immediately executes it. HTTPS protects the connection in transit under normal conditions, but the script does not pin an installer version, verify a locally trusted checksum, or validate a digital signature before execution.

The documentation states that the downloaded installer verifies the checksum of the eventual release archive. That verification does not establish the integrity of the installer itself: a compromised installer could alter or omit its own downstream checks.

Consequently, the effective code executed by the Skill can change after the repository has been reviewed. Compromise of the remote distribution endpoint, its publishing process, or a trusted certificate or delivery component could turn the mandatory setup step into arbitrary code execution.

Attack Path

1. An attacker compromises the remote installer endpoint or its release and publishing infrastructure.
2. The attacker replaces or modifies the script returned by https://bws.bitwarden.com/install.
3. A user or agent invokes the Skill on a system where bws is not installed.
4. The Skill runs scripts/ensure-bws.sh as required by its startup instructions.
5. The helper downloads the attacker-controlled script to a temporary file.
6. `sh "$install ...[truncated 758 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the installer to a reviewed, immutable version rather than using a mutable generic endpoint.
2. Publish a trusted SHA-256 digest or signature with the Skill and verify it before execution.
3. Prefer downloading a signed release binary directly and validating its signature and checksum locally.
4. Fail closed if verification cannot be completed; never execute an unverified download.
5. Replace the Windows iwr ... | iex recommendation with a download, verification, and execution sequence.
6. Do not make installation an automatic startup action. Ask for explicit user approval before downloading and executing external code.
7. Prefer a trusted operating-system package manager where signed, version-pinned packages are available.

T08 · Insecure Dependencies

Warning

• Location: README.md:16

Finding

Unpinned npx Package Execution in Installation Instructions

Content

View full analysis

Vulnerability Details

File Location: README.md:16-38
Vulnerability Type: Unpinned third-party package resolution and execution
Risk Level: Medium

Vulnerable Code

bash

npx skills add hajekt2/bitwarden-secrets-manager-cli

Additional documented variants invoke the same unpinned package:

bash

npx skills add hajekt2/bitwarden-secrets-manager-cli -g

bash

npx skills add hajekt2/bitwarden-secrets-manager-cli \
  --skill bitwarden-secrets-manager-cli \
  --agent codex \
  --global \
  --yes

bash

npx skills add hajekt2/bitwarden-secrets-manager-cli --list

Technical Analysis

The installation documentation invokes the npm package named skills without specifying an exact package version or integrity value. Depending on local npm state, npx may retrieve the currently resolved package version from the configured npm registry and execute its code.

The executed dependency can therefore change independently of the audited repository. A compromised publisher account, malicious release, registry compromise, or unexpected incompatible update could introduce arbitrary behavior into the installation process. The noninteractive --yes example further reduces the opportunity for a user to inspect installation choices.

Attack Path

1. An attacker compromises the npm package, its publisher account, or the configured package registry.
2. The attacker publishes a malicious version that satisfies the unpinned skills package request.
3. A user follows the repository installation instructions.
4. npx resolves and downloads the attacker-controlled package version.
5. The package executes with the privileges and environment of the invoking user.
6. The malicious package can access files, credentials, agent configuration, and network resources available to that account.

Impact Assessment

Successful exploitation provides code execution as the user runn ...[truncated 439 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the CLI to an exact reviewed version, for example npx skills@X.Y.Z ....
2. Document the expected package publisher, registry, package digest, and verification procedure.
3. Prefer lockfile-backed installation in controlled environments.
4. Recommend npm configuration that enforces the official registry and package integrity checks.
5. Review each dependency update before changing the pinned version.
6. Avoid noninteractive global installation examples unless required, and clearly describe the code execution and trust implications.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:96

Finding

Secret Values Passed Through Process Arguments

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:96-99
Vulnerability Type: Sensitive values exposed in command-line arguments
Risk Level: Medium

Vulnerable Code

bash

bws project create "$PROJECT_NAME" --output none
bws project edit "$PROJECT_ID" --name "$NEW_NAME" --output none
bws secret create "$SECRET_KEY" "$SECRET_VALUE" "$PROJECT_ID" --output none
bws secret edit "$SECRET_ID" --value "$SECRET_VALUE" --output none

Technical Analysis

Shell expansion substitutes "$SECRET_VALUE" into the argument vector supplied to the bws process. Quoting prevents shell word splitting and command injection, but it does not conceal the resulting value from process-level observation.

Depending on the operating system and execution environment, command arguments may be captured by same-user process inspection, endpoint monitoring software, audit frameworks, process wrappers, crash diagnostics, CI telemetry, or agent execution traces. Disabling shell tracing only prevents one disclosure channel and does not protect the process argument vector.

The reference guide acknowledges that secret values passed to create or edit operations become command arguments, but the primary workflow still recommends those commands for secret mutations.

Attack Path

1. An agent obtains a sensitive value through an environment variable or other runtime channel.
2. The agent follows the documented create or edit example.
3. The shell expands "$SECRET_VALUE" and places the plaintext secret in the bws process argument vector.
4. A same-user process monitor, endpoint telemetry component, audit logger, wrapper, or diagnostic tool records or reads the arguments while the command is running.
5. An attacker with access to that telemetry or monitoring context recovers the secret.
6. The attacker uses the exposed value against the service for which the secret is valid.

Impact Assessment

Exposure is limited to the ...[truncated 447 chars]

Remediation

View remediation

Remediation Suggestions

1. Use a bws input mode that accepts secret values from standard input, a dedicated file descriptor, or another non-argument channel if supported by the installed version.
2. If the CLI lacks a secure input mechanism, avoid agent-driven secret create and edit operations involving sensitive values.
3. Clearly warn that environment-variable expansion does not keep values out of the process argument vector.
4. Disable shell tracing and command echoing, while documenting that this is only defense in depth.
5. Prevent command arguments from being captured by CI logs, endpoint telemetry, wrappers, and agent traces where administratively possible.
6. Use short-lived, least-privilege credentials so exposure has limited scope and duration.
7. Rotate any credential suspected of having been captured in process telemetry.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (30)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · .gitignore (reported line 1)May include surrounding context.

text

.env
.env.*
.DS_Store

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 5)May include surrounding context.

md

An Agent Skill for working safely with [Bitwarden Secrets Manager](https://bitwarden.com/products/secrets-manager/) through the `bws` command-line interface.

The skill helps AI coding agents install and operate `bws`, authenticate with a machine-account access token, inspect projects and secrets, inject secrets into trusted processes, and manage Secrets Manager resources without exposing sensitive values.

This repository follows the open [Agent Skills specification](https://agentskills.io) and can be installed with the [Skills CLI](https://github.com/vercel-labs/skills) into Codex, Claude Code, Cursor, and other supported agents.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 63)May include surrounding context.

md

An Agent Skill for working safely with [Bitwarden Secrets Manager](https://bitwarden.com/products/secrets-manager/) through the `bws` command-line interface.

The skill helps AI coding agents install and operate `bws`, authenticate with a machine-account access token, inspect projects and secrets, inject secrets into trusted processes, and manage Secrets Manager resources without exposing sensitive values.

This repository follows the open [Agent Skills specification](https://agentskills.io) and can be installed with the [Skills CLI](https://github.com/vercel-labs/skills) into Codex, Claude Code, Cursor, and other supported agents.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 70)May include surrounding context.

md

An Agent Skill for working safely with [Bitwarden Secrets Manager](https://bitwarden.com/products/secrets-manager/) through the `bws` command-line interface.

The skill helps AI coding agents install and operate `bws`, authenticate with a machine-account access token, inspect projects and secrets, inject secrets into trusted processes, and manage Secrets Manager resources without exposing sensitive values.

This repository follows the open [Agent Skills specification](https://agentskills.io) and can be installed with the [Skills CLI](https://github.com/vercel-labs/skills) into Codex, Claude Code, Cursor, and other supported agents.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 9)May include surrounding context.

md

An Agent Skill for working safely with [Bitwarden Secrets Manager](https://bitwarden.com/products/secrets-manager/) through the `bws` command-line interface.

The skill helps AI coding agents install and operate `bws`, authenticate with a machine-account access token, inspect projects and secrets, inject secrets into trusted processes, and manage Secrets Manager resources without exposing sensitive values.

This repository follows the open [Agent Skills specification](https://agentskills.io) and can be installed with the [Skills CLI](https://github.com/vercel-labs/skills) into Codex, Claude Code, Cursor, and other supported agents.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md

An Agent Skill for working safely with [Bitwarden Secrets Manager](https://bitwarden.com/products/secrets-manager/) through the `bws` command-line interface.

The skill helps AI coding agents install and operate `bws`, authenticate with a machine-account access token, inspect projects and secrets, inject secrets into trusted processes, and manage Secrets Manager resources without exposing sensitive values.

This repository follows the open [Agent Skills specification](https://agentskills.io) and can be installed with the [Skills CLI](https://github.com/vercel-labs/skills) into Codex, Claude Code, Cursor, and other supported agents.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

md

An Agent Skill for working safely with [Bitwarden Secrets Manager](https://bitwarden.com/products/secrets-manager/) through the `bws` command-line interface.

The skill helps AI coding agents install and operate `bws`, authenticate with a machine-account access token, inspect projects and secrets, inject secrets into trusted processes, and manage Secrets Manager resources without exposing sensitive values.

This repository follows the open [Agent Skills specification](https://agentskills.io) and can be installed with the [Skills CLI](https://github.com/vercel-labs/skills) into Codex, Claude Code, Cursor, and other supported agents.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

md

An Agent Skill for working safely with [Bitwarden Secrets Manager](https://bitwarden.com/products/secrets-manager/) through the `bws` command-line interface.

The skill helps AI coding agents install and operate `bws`, authenticate with a machine-account access token, inspect projects and secrets, inject secrets into trusted processes, and manage Secrets Manager resources without exposing sensitive values.

This repository follows the open [Agent Skills specification](https://agentskills.io) and can be installed with the [Skills CLI](https://github.com/vercel-labs/skills) into Codex, Claude Code, Cursor, and other supported agents.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/cli-guide.md (reported line 46)May include surrounding context.

md

An Agent Skill for working safely with [Bitwarden Secrets Manager](https://bitwarden.com/products/secrets-manager/) through the `bws` command-line interface.

The skill helps AI coding agents install and operate `bws`, authenticate with a machine-account access token, inspect projects and secrets, inject secrets into trusted processes, and manage Secrets Manager resources without exposing sensitive values.

This repository follows the open [Agent Skills specification](https://agentskills.io) and can be installed with the [Skills CLI](https://github.com/vercel-labs/skills) into Codex, Claude Code, Cursor, and other supported agents.

Unvalidated Output Injection

High

• Category: Output Handling
• Confidence: 80% confidence

Finding

Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.

Content

Scanner excerpt · README.md (reported line 111)May include surrounding context.

md

- Keep access tokens and secret values out of prompts, logs, process arguments, and version control.
- Start with read-only discovery before changing remote state.
- Filter `bws secret list` and `bws secret get` output because raw responses include decrypted values.
- Use `--output none` for mutations unless response metadata is required.
- Resolve exact resource IDs before editing or deleting anything.
- Require explicit authorization before deleting projects or secrets.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 109)May include surrounding context.

md

---
name: bitwarden-secrets-manager-cli
description: Operate Bitwarden Secrets Manager through the `bws` CLI, including installing the CLI when missing, authenticating with machine-account access tokens, configuring US, EU, or self-hosted servers, listing and managing projects and secrets, and injecting secrets into trusted processes. Use for requests involving Bitwarden Secrets Manager, `bws`, `BWS_ACCESS_TOKEN`, machine accounts, secret retrieval, secret injection, or Secrets Manager automation and CI/CD.
---

# Bitwarden Secrets Manager CLI

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 170)May include surrounding context.

md

---
name: bitwarden-secrets-manager-cli
description: Operate Bitwarden Secrets Manager through the `bws` CLI, including installing the CLI when missing, authenticating with machine-account access tokens, configuring US, EU, or self-hosted servers, listing and managing projects and secrets, and injecting secrets into trusted processes. Use for requests involving Bitwarden Secrets Manager, `bws`, `BWS_ACCESS_TOKEN`, machine accounts, secret retrieval, secret injection, or Secrets Manager automation and CI/CD.
---

# Bitwarden Secrets Manager CLI

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: bitwarden-secrets-manager-cli
description: Operate Bitwarden Secrets Manager through the `bws` CLI, including installing the CLI when missing, authenticating with machine-account access tokens, configuring US, EU, or self-hosted servers, listing and managing projects and secrets, and injecting secrets into trusted processes. Use for requests involving Bitwarden Secrets Manager, `bws`, `BWS_ACCESS_TOKEN`, machine accounts, secret retrieval, secret injection, or Secrets Manager automation and CI/CD.
---

# Bitwarden Secrets Manager CLI

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/cli-guide.md (reported line 9)May include surrounding context.

md

Official sources:

- [Secrets Manager CLI](https://bitwarden.com/help/secrets-manager-cli/)
- [Access tokens](https://bitwarden.com/help/access-tokens/)
- [`bws` source and releases](https://github.com/bitwarden/sdk-sm)

## Install

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/cli-guide.md (reported line 150)May include surrounding context.

md

## Troubleshoot

`Missing access token`:

- Confirm `BWS_ACCESS_TOKEN` exists in the process that launches `bws`.
- Do not print the variable while checking it.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill invokes shell commands and helper scripts but does not declare any explicit tool scope or allowed-tools boundary. That omission weakens containment and reviewability, making it easier for an agent runtime to execute broader shell actions than intended when handling secrets or destructive Bitwarden operations.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.

text

Prefer `BWS_SERVER_URL`, `BWS_PROFILE`, or a task-specific config file when the configuration should be temporary or isolated.
Do not overwrite an existing default profile without checking it first.