ClawHub
Back to skill

Security audit

Bitwarden

Security checks for vulnerabilities and agentic risk

Overview

This Bitwarden skill is mostly coherent, but its example workflow can expose password-vault contents through terminal capture and leaves an unlocked vault session in a weakly scoped tmux setup.

Review before installing. Use this only in a trusted local environment, avoid the documented pane-capture access test, do not let the agent print full vault items into chat or logs, and prefer explicit user-approved commands that retrieve only the specific field needed. If using the Vaultwarden test setup, replace the sample token and password and keep it local-only.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:50
Finding

Vault Records Exposed Through Terminal Capture

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 50–55
Vulnerability Type: Sensitive data exposure through terminal output capture
Risk Level: High

Vulnerable Code:

bash
tmux -S "$SOCKET" send-keys -t "$SESSION":0.0 -- 'bw list items --search github' Enter

# Capture output
tmux -S "$SOCKET" capture-pane -p -J -t "$SESSION":0.0 -S -200

Technical Analysis

The authenticated bw list items --search github command can return complete matching Bitwarden item objects rather than a minimal access-status result. Such records may contain passwords, usernames, authentication data, secure notes, URIs, and custom fields.

The subsequent tmux capture-pane command extracts up to 200 lines of terminal history. In an agent-driven environment, this captured output may be returned through tool responses and consequently retained in chat transcripts, application logs, telemetry, or other execution traces.

This behavior conflicts with the skill's own guardrail prohibiting secrets from being pasted into logs, chat, or code. Although capture is not inherently malicious, capturing unrestricted output from an authenticated password-vault command creates a direct sensitive-data disclosure risk.

Attack Path

  1. A user or agent follows the documented workflow and unlocks the Bitwarden vault.
  2. The resulting BW_SESSION grants the tmux shell authenticated vault access.
  3. The skill runs bw list items --search github.
  4. Bitwarden prints matching vault records into the tmux pane.
  5. tmux capture-pane collects the terminal output, including any sensitive fields.
  6. The captured data is returned to the invoking agent or tool infrastructure.
  7. Vault data may then persist in chat history, logs, telemetry, or downstream processing systems accessible to parties that do not have direct vault authorization.

Impact Assessment

Exploitation does not grant additional operating-system privileges, ...[truncated 515 chars]

Remediation
View remediation

Remediation Suggestions

  • Do not capture terminal panes containing output from commands that return secrets or complete vault records.
  • Replace the access test with a non-secret operation such as bw status, or another command whose output cannot contain vault content.
  • If record retrieval is explicitly requested, obtain only the minimum necessary field and avoid returning it through chat, logs, or tool traces.
  • Do not use bw list items as a generic authentication check.
  • Separate secret-producing commands from diagnostic output that may be captured.
  • Clear pane history before diagnostic capture and terminate the tmux session immediately after use.
  • Apply output redaction at the tool boundary as defense in depth, while recognizing that redaction should not replace minimizing secret output.
  • Require explicit user authorization before retrieving passwords, TOTP values, secure notes, or complete vault items.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:40
Finding

Authenticated tmux Session Uses an Insufficiently Protected Predictable Socket Path

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 40–48
Vulnerability Type: Unsafe temporary socket configuration and local session exposure
Risk Level: Medium

Vulnerable Code:

bash
SOCKET_DIR="${CLAWDBOT_TMUX_SOCKET_DIR:-${TMPDIR:-/tmp}/openclaw-tmux-sockets}"
mkdir -p "$SOCKET_DIR"
SOCKET="$SOCKET_DIR/openclaw-bw.sock"
SESSION="bw-auth-$(date +%Y%m%d-%H%M%S)"

tmux -S "$SOCKET" new -d -s "$SESSION" -n shell

# Unlock and capture session key
tmux -S "$SOCKET" send-keys -t "$SESSION":0.0 -- 'export BW_SESSION=$(bw unlock --raw)' Enter

Technical Analysis

The skill creates a tmux control socket at a predictable path, normally under a temporary directory. It does not establish a restrictive umask, explicitly set the socket directory to mode 0700, verify directory ownership, or reject a pre-existing path with unsafe permissions.

This tmux session contains an unlocked Bitwarden environment because BW_SESSION is exported inside its shell. A local party capable of accessing the control socket could interact with the authenticated shell, submit Bitwarden commands, or capture terminal output.

Actual exploitability depends on the operating system, tmux's socket permissions, the user's umask, and the ownership and permissions of the socket directory. Nevertheless, the documented construction fails to enforce the security boundary required for a session that handles vault credentials.

Attack Path

  1. The attacker has local access to the same host and can inspect or influence the temporary socket location.
  2. The attacker identifies the predictable openclaw-tmux-sockets/openclaw-bw.sock path or prepares an insecure pre-existing directory where permitted.
  3. The user follows the skill workflow and creates the tmux session at that path.
  4. The skill unlocks Bitwarden and exports BW_SESSION in the tmux shell.
  5. If filesystem permissions permit socket access, the attacker connect ...[truncated 902 chars]
Remediation
View remediation

Remediation Suggestions

  • Set umask 077 before creating any directory or socket used by the authenticated session.
  • Create a unique, user-owned directory with mode 0700, preferably using mktemp -d rather than a shared predictable directory.
  • Verify that the directory is owned by the current user, is not a symbolic link, and has no group or world permissions before starting tmux.
  • Use an unpredictable socket filename within the private directory.
  • Refuse to reuse a pre-existing socket or directory that fails ownership and permission checks.
  • Register cleanup traps that run bw lock, terminate the tmux session, and remove the socket and temporary directory on normal completion, interruption, or error.
  • Minimize the authenticated session lifetime and avoid leaving an unlocked session unattended.
  • Ensure the runtime environment does not expose the tmux socket directory through shared volumes or overly permissive container mounts.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill publishes concrete credentials and an admin token without a strong, explicit local-only warning. Even if intended for a disposable test environment, users may reuse them, leave the environment exposed, or copy the pattern into real deployments, enabling unauthorized access to the Vaultwarden instance and administrative takeover.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The manifest presents the skill as a Bitwarden CLI helper focused on installing bw, unlocking the vault, and retrieving or generating secrets. The testing section introduces a broader capability: provisioning and operating a local self-hosted Bitwarden-compatible service stack, which is a separate infrastructure-management task not justified by the stated purpose.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The manifest describes this skill as setting up and using the Bitwarden CLI for installation, vault unlock, session handling, and secret access/generation. The documented bw config server https://localhost:8443 step adds a separate capability to retarget the CLI to a different backend server, which is not mentioned in the stated scope and is not necessary for the core secret-reading workflow.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.