Bitwarden
v1.0.0Bitwarden integration. Manage security and password-management data, records, and workflows. Use when the user wants to interact with Bitwarden data.
⭐ 0· 59·0 current·0 all-time
byMembrane Dev@membranedev
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The name/description (Bitwarden integration) matches the instructions: all actions are performed through the Membrane CLI and via a Membrane Bitwarden connector. There are no unrelated environment variables, binaries, or config paths declared that would be inconsistent with a Bitwarden integration.
Instruction Scope
SKILL.md only instructs using the Membrane CLI (login, connection management, action list/run, proxy requests) and Bitwarden API via Membrane's proxy. It does not direct the agent to read unrelated files, environment variables, or system configuration. It does require network access and a Membrane account, which is appropriate for this integration.
Install Mechanism
There is no platform install spec; SKILL.md recommends installing @membranehq/cli globally via npm (npm install -g @membranehq/cli). Installing a global npm package is a reasonable way to get the CLI, but npm packages run arbitrary code and represent a moderate supply-chain risk — users should verify package provenance and prefer pinned versions or official install instructions from the vendor.
Credentials
The skill declares no required environment variables or local credentials and explicitly tells users not to provide API keys. Instead, it relies on a Membrane account and server-side connectors to manage auth. This is proportionate to the described purpose, but it does mean your Bitwarden access credentials will be managed/stored by the third-party Membrane service rather than kept purely local — consider privacy/hosting implications.
Persistence & Privilege
The skill does not request always: true, does not modify other skills or system-wide agent settings, and does not require persistent system privileges. Autonomous invocation is allowed (platform default) but not excessive for this type of integration.
Assessment
This skill appears to do what it says: use Membrane to connect to Bitwarden. Before installing or using it: (1) Understand that you must create/use a Membrane account — Membrane will broker access to your Bitwarden data, so review their security/privacy and where credentials/tokens are stored. (2) Installing the CLI via npm (npm install -g @membranehq/cli) runs third-party code; verify the package is official (check getmembrane.com and the package repo) and consider pinning a version. (3) When creating connections, review the permissions/scopes requested by the connector and use least privilege. (4) If you require that Bitwarden secrets never leave your infrastructure, do not use a third-party proxy. If you want more assurance, ask the skill author for an explicit trust/publishing provenance (package homepage, signing, or GitHub release links).Like a lobster shell, security has layers — review code before you run it.
latestvk97b6sex74rcfwfv83cqz34ck584bnx7
License
MIT-0
Free to use, modify, and redistribute. No attribution required.