ClawHub
Back to skill

Security audit

bitclawden

Security checks for vulnerabilities and agentic risk

Overview

This Bitwarden skill is purpose-aligned, but its built-in installer downloads and installs a vault-accessing CLI binary without integrity verification, so users should review it before installing.

Install this only if you are comfortable granting an agent access to your Bitwarden vault through BW_SESSION. Prefer installing the Bitwarden CLI through Bitwarden's documented package-manager path or another verified method instead of the built-in script, and only ask the skill to reveal passwords or TOTP codes when you explicitly need them.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:18
Finding
Unverified Remote Bitwarden CLI Download and Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 18 **Vulnerability Type**: Unverified remote payload retrieval and installation **Risk Level**: High ### Vulnerable Code ```sh PLATFORM=$(uname -s | tr '[:upper:]' '[:lower:]'); [ "$PLATFORM" = 'darwin' ] && PLATFORM='macos'; curl -sL "https://vault.bitwarden.com/download/?app=cli&platform=${PLATFORM}" -o /tmp/bw.zip && unzip -o /tmp/bw.zip -d ~/.local/bin/ && chmod +x ~/.local/bin/bw && rm /tmp/bw.zip ``` ### Technical Analysis The installation command downloads a mutable Bitwarden CLI archive from an external URL, extracts it directly into `~/.local/bin`, and marks the resulting `bw` file executable. It does not pin a specific release or verify an official checksum or cryptographic signature before installation. Although the archive is retrieved over HTTPS from the official Bitwarden domain, `curl -L` follows redirects and the downloaded content remains dependent on external infrastructure at installation time. Consequently, the effective executable can differ from the content available when the skill was reviewed. The command also uses the predictable shared path `/tmp/bw.zip` and invokes `unzip -o`, which overwrites files without prompting. These practices create additional opportunities for local temporary-file interference and unsafe archive extraction. ### Attack Path 1. A user or agent invokes the skill's built-in Bitwarden CLI installer. 2. The installer requests a mutable external download URL and follows redirects. 3. An attacker compromises the distribution or redirect path, or interferes with the predictable temporary archive path under applicable local conditions. 4. A modified archive is stored as `/tmp/bw.zip`. 5. Because no checksum or signature is verified, the archive is accepted automatically. 6. `unzip -o` writes the attacker-controlled `bw` executable into `~/.local/bin`. 7. The file is granted executable permissions and is subsequently invoked by the documented ...[truncated 913 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Pin the Bitwarden CLI to an explicitly approved version and use a version-specific official download URL. 2. Obtain the expected SHA-256 digest through a trusted, independently authenticated release channel. 3. Verify the archive before extraction and abort installation if verification fails. 4. If Bitwarden publishes cryptographic signatures, validate the signature against a pinned and trusted signing key. 5. Use strict download options such as: ```sh curl --fail --show-error --location ``` 6. Replace the predictable `/tmp/bw.zip` path with a private temporary directory: ```sh tmpdir="$(mktemp -d)" trap 'rm -rf "$tmpdir"' EXIT ``` 7. Inspect and validate archive entries before extraction, rejecting absolute paths, traversal sequences, symbolic-link surprises, and unexpected files. 8. Extract into the private temporary directory first, verify the resulting executable, and then install it atomically into `~/.local/bin`. 9. Avoid unconditional overwrite behavior such as `unzip -o` unless the destination and archive contents have both been validated. 10. Prefer directing users to the platform's official package manager or Bitwarden's documented installation procedure where practical. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

Tool Parameter Abuse

High
Category
Tool Misuse
Content
{
              "id": "bw-binary",
              "kind": "script",
              "script": "PLATFORM=$(uname -s | tr '[:upper:]' '[:lower:]'); [ \"$PLATFORM\" = 'darwin' ] && PLATFORM='macos'; curl -sL \"https://vault.bitwarden.com/download/?app=cli&platform=${PLATFORM}\" -o /tmp/bw.zip && unzip -o /tmp/bw.zip -d ~/.local/bin/ && chmod +x ~/.local/bin/bw && rm /tmp/bw.zip",
              "bins": ["bw"],
              "requires": ["curl", "unzip"],
              "label": "Install Bitwarden CLI to ~/.local/bin",
Confidence
85% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Session Persistence

Medium
Category
Rogue Agent
Content
## What it does

- Look up usernames, passwords, and TOTP codes
- Create new vault items (logins, secure notes, cards, identities)
- Edit existing items
- Generate strong passwords and passphrases
- Sync vault changes
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Vague Triggers

Medium
Confidence
96% confidence
Finding
The invocation guidance says to use the skill when asked to "store, retrieve, find, or manage passwords, secrets, or credentials," which is a broad natural-language trigger without clear scope boundaries or exclusion conditions. Terms like "find" and "manage" are generic enough to match many ordinary requests, increasing the risk of unintended activation.

External Transmission

Medium
Category
Data Exfiltration
Content
{
              "id": "bw-binary",
              "kind": "script",
              "script": "PLATFORM=$(uname -s | tr '[:upper:]' '[:lower:]'); [ \"$PLATFORM\" = 'darwin' ] && PLATFORM='macos'; curl -sL \"https://vault.bitwarden.com/download/?app=cli&platform=${PLATFORM}\" -o /tmp/bw.zip && unzip -o /tmp/bw.zip -d ~/.local/bin/ && chmod +x ~/.local/bin/bw && rm /tmp/bw.zip",
              "bins": ["bw"],
              "requires": ["curl", "unzip"],
              "label": "Install Bitwarden CLI to ~/.local/bin",
Confidence
90% confidence
Finding
The install script downloads and executes a security-sensitive binary path from the network using curl, then places the resulting executable in ~/.local/bin without any integrity or authenticity verification. In a credential-management skill, this is especially risky because a tampered CLI could steal vault data, session tokens, or user secrets once invoked.

Static analysis

No suspicious patterns detected.