Openclaw Skill Bitwarden

• Analyzed: May 12, 2026, 4:18 AM
• Findings: 1
• Version: 1.0.3
• Hash: 081b175e8bab1526f768469804d8bfe4836bd9c3c499ca555f916e553e5a8a26
• Source: palm
• External report: View on VirusTotal

Findings (1)

The OpenClaw Bitwarden skill is designed to integrate with Bitwarden/Vaultwarden for password management. It transparently declares its access to environment variables, local files, and network endpoints (user-configured BW_SERVER). The `bw.sh` script includes explicit security measures, such as safe parsing of credential files to prevent shell injection (as highlighted in `README.md`'s 'Security Improvements in v1.0.1') and proper `chmod 600` permissions for session token files. While it handles highly sensitive data (master passwords, session tokens) and includes an embedded Python script for cryptographic operations during account registration, these actions are aligned with the stated purpose and use standard, well-documented cryptographic practices and libraries. There is no evidence of intentional data exfiltration to unauthorized endpoints, persistence mechanisms, obfuscation, or prompt injection attempts against the agent to perform malicious actions.