ClawHub
Back to skill

Security audit

Bitwarden

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward Bitwarden CLI helper that can access vault data when used, but its sensitive behavior is disclosed and aligned with its purpose.

Install only if you want an agent to use Bitwarden CLI for specific vault tasks. Prefer narrow lookups over broad listing, do not share captured terminal output, treat tmux history as sensitive, and lock Bitwarden plus kill the tmux session when finished. Do not reuse the sample Vaultwarden credentials outside disposable local testing.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill embeds explicit test credentials and an admin token directly in documentation, and although the section is framed as local Vaultwarden testing, it does not prominently warn against reuse outside an isolated local environment. Hardcoded credentials are routinely copied into real setups, committed elsewhere, or left unchanged, which can lead to unauthorized access if the environment is exposed or if users mistakenly treat them as acceptable defaults.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.