bitclawden
v1.0.1Look up, create, and edit credentials in Bitwarden vault via the bw CLI. Use when asked to store, retrieve, find, or manage passwords, secrets, or credentials.
⭐ 0· 406·0 current·0 all-time
byAdam Malone@typhonius
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (Bitwarden CLI management) match the declared requirements: bw and jq binaries and a Bitwarden session token (BW_SESSION). These are exactly what a CLI-based Bitwarden skill needs.
Instruction Scope
SKILL.md only instructs the agent to run bw/jq commands, check vault status, require unlocking and a BW_SESSION, sync after changes, and avoid leaking secrets. It does not ask for unrelated files, credentials, or exfiltration steps.
Install Mechanism
Skill is instruction-only in the registry, but the SKILL.md metadata includes an optional install script that downloads the bw CLI from https://vault.bitwarden.com/download/?app=cli and unzips it to ~/.local/bin. The source is the official Bitwarden domain (low risk), but there is a small inconsistency between 'No install spec' in the registry metadata and the embedded install script in SKILL.md.
Credentials
Only BW_SESSION is required (declared as primaryEnv). No unrelated secrets or multiple credentials are requested; this is proportional to the skill's function.
Persistence & Privilege
always is false and the skill does not request system-wide changes or other skills' credentials. It does propose writing a binary to ~/.local/bin only if its optional install script is used (local scope).
Assessment
This skill appears coherent for managing Bitwarden via the bw CLI, but review these points before installing:
- Confirm you have bw and jq installed (or be prepared to run the provided install script) and that ~/.local/bin is an acceptable install location.
- The install script fetches from vault.bitwarden.com (official); still verify network policy and inspect the script if you have strict supply-chain rules.
- BW_SESSION is a live session token: treat it as a secret. Prefer short-lived sessions and avoid committing it to files or global environment variables.
- The skill’s guardrails say passwords should only be revealed on explicit request; be mindful of prompts and what the agent returns to chat or logs.
- Note the minor inconsistency: registry metadata listed no install spec while SKILL.md contains an install script — ask the publisher which install flow they expect if this matters to you.
If you accept those conditions, the skill is internally consistent with its stated purpose.Like a lobster shell, security has layers — review code before you run it.
latestvk979m9evh7ng4gsxx86c4y3f3x81n87m
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🔐 Clawdis
Binsbw, jq
EnvBW_SESSION
Primary envBW_SESSION
