ClawHub
Back to skill

Security audit

Bitwarden Secrets Manager CLI

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly coherent for Bitwarden Secrets Manager use, but it can automatically run a downloaded installer and operate in a sensitive secrets environment.

Review before installing. This skill is designed for legitimate Bitwarden Secrets Manager work, but only use it in an environment where you are comfortable giving the agent access to the machine-account token and assigned secrets. Prefer installing `bws` yourself from a verified source before using the skill, and require explicit confirmation before any install, secret retrieval, mutation, deletion, or `bws run` command that passes secrets to another process.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill clearly instructs the agent to execute shell commands (`scripts/ensure-bws.sh`, `bws`, helper scripts), but no declared permissions are present. This creates a capability/permission mismatch that can weaken sandboxing, review, and user understanding of what the skill is allowed to do.

Vague Triggers

Medium
Confidence
86% confidence
Finding
The README states that agents may invoke the skill automatically when a request merely mentions broad Bitwarden-related terms. This can cause the skill to activate outside the user's intended scope, increasing the chance that an agent performs secret-manager discovery or authentication-related actions in response to incidental mentions rather than an explicit request.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The script downloads a remote installer over HTTPS and immediately executes it with `sh` without verifying a pinned checksum, signature, or reviewed local copy. If the download source, DNS/TLS trust chain, or hosting environment is compromised, this becomes arbitrary code execution on the user's machine; in a secrets-management skill, that code could also steal `BWS_ACCESS_TOKEN` values and retrieved secrets.

Static analysis

No suspicious patterns detected.