Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Securely interact with Bitwarden/Vaultwarden vaults using rbw CLI. Use when retrieving credentials, managing vault items, or integrating secrets into scripts/systemd services. Handles authentication, field access, and non-interactive operation patterns.
v1.0.0Securely interact with Bitwarden/Vaultwarden vaults using rbw CLI. Use when retrieving credentials, managing vault items, or integrating secrets into scripts...
⭐ 1· 440·1 current·1 all-time
byDenis Pisarev@tripleight
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill's name/description (non-interactive rbw usage) aligns with the SKILL.md content: commands, get/list/add, and systemd/script integration are all relevant to the stated purpose.
Instruction Scope
The runtime instructions tell the operator/agent to create a pinentry wrapper that reads RBW_MASTER_PASSWORD and to store the master password in /etc/systemd/rbw-credentials.conf (plaintext), and to configure systemd EnvironmentFile. The SKILL.md therefore instructs reading/writing system-level files and using an environment variable not declared in the skill metadata. These actions go beyond simply invoking rbw and involve system-wide sensitive state.
Install Mechanism
This is instruction-only (no install spec, no binaries shipped). That minimizes install-time risk because nothing is downloaded or written by an installer, but it assumes rbw/pinentry/jq/curl are available on the host.
Credentials
The SKILL.md relies on the RBW_MASTER_PASSWORD environment variable and on an EnvironmentFile under /etc/systemd, but the skill metadata declares no required env vars or credentials. Requiring a master password (and storing it as plaintext) is functionally consistent with non-interactive unlocking but the metadata mismatch and the need for a sensitive secret stored at root-level are disproportionate without explicit declaration and justification.
Persistence & Privilege
The skill does not request always:true and does not self-install, but its recommended pattern requires creating system files under /etc and adjusting systemd service EnvironmentFile entries (requires root). That means installation/run will need elevated privileges and will persist a sensitive secret on disk unless the user chooses alternative approaches.
What to consider before installing
This skill's instructions are coherent with its goal (non-interactive rbw usage) but they ask you to store your Bitwarden master password in plaintext and rely on an undeclared RBW_MASTER_PASSWORD environment variable and an /etc systemd file. Before using/installing: (1) verify the rbw binary and other tools (pinentry, jq, curl) are from trusted sources; (2) prefer safer non-interactive patterns if possible (systemd LoadCredential=, OS keyring, hardware token, or ephemeral service accounts) instead of plaintext files; (3) if you must use the provided pattern, restrict the credential file to root:root 600 and minimize who can read/modify systemd unit files; (4) confirm you trust the skill source (homepage unknown) and test in an isolated environment first; (5) consider editing the SKILL.md or your deployment to declare RBW_MASTER_PASSWORD explicitly and to document audit/trust controls. If you need, ask for a version that uses a recommended secure alternative (systemd LoadCredential or an external secret provider) instead of plaintext credentials.Like a lobster shell, security has layers — review code before you run it.
latestvk97b8scg0n0d8fked0che1ge8h81vcrc
License
MIT-0
Free to use, modify, and redistribute. No attribution required.