Openclaw Skill Bitwarden

• Risk level: Low
• Analyzed: Feb 18, 2026, 3:22 PM
• Findings: 0
• Version: 1.0.3

Overview

The skill's code, runtime instructions, and required secrets are coherent with a Bitwarden/Vaultwarden CLI wrapper — nothing requests unrelated credentials or calls unexpected endpoints.

This skill appears to do exactly what it claims: wrap the Bitwarden CLI and optionally register accounts on the Bitwarden/Vaultwarden server you configure. Before installing: 1) Ensure you trust the BW_SERVER URL you will set — the skill will send authentication and vault requests only to that server. 2) Install the Bitwarden CLI (bw), python3, and the Python packages (cryptography, requests) as described. 3) Protect your credentials file (CREDS_FILE) with strict permissions (chmod 600) and consider using a dedicated low-privilege vault account for OpenClaw. 4) If you do not want automatic retrieval of secrets, configure your OpenClaw tool policy to require manual approval (the skill can be invoked autonomously by default). 5) Note the small metadata mismatch (primaryEnv declared in SKILL.md but not in registry metadata) — benign but worth reconciling if you rely on registry metadata for automation.