Twhidden Bitwarden

Bitwarden & Vaultwarden password manager integration. Use when storing, retrieving, generating, or managing passwords and credentials. Wraps the Bitwarden CL...

This skill appears to do what it says: wrap the Bitwarden CLI and manage a Bitwarden/Vaultwarden account. Before installing, consider the following: 1) You will need to provide your master password (BW_MASTER_PASSWORD) — this is necessary but highly sensitive; prefer a dedicated account or minimize exposure time. 2) The script can read a credentials file (CREDS_FILE) in your OpenClaw workspace; ensure that file is protected (chmod 600) and not committed to source control. 3) The script writes a session token to /tmp/.bw_session; the script sets restrictive permissions, but you should verify your environment's /tmp policies. 4) If you want human approval before the agent stores or retrieves passwords, limit autonomous invocation via your OpenClaw tool policy. 5) If you have concerns about the packaged code, review bw.sh yourself (it's included) or obtain the skill from a trusted origin (verify the GitHub/homepage and commit history).

Type: OpenClaw Skill Name: twhidden-bitwarden Version: 1.0.5 The OpenClaw Bitwarden skill is benign. It provides a wrapper for the Bitwarden CLI, enabling password management functionalities like login, registration, and CRUD operations. The `bw.sh` script explicitly implements safe credential loading to prevent shell injection from configuration files, uses `chmod 600` for session tokens, and clearly documents all external communication with the user-configured Bitwarden server. While the `do_register` function in `bw.sh` involves complex cryptographic operations implemented in bash using `openssl`, it is for the stated purpose of account registration and shows no signs of malicious intent or unauthorized data exfiltration. No prompt injection attempts against the agent were found in `SKILL.md` or `README.md`.