Bitwarden

Set up and use Bitwarden CLI (bw). Use when installing the CLI, unlocking vault, or reading/generating secrets via bw. Handles session management with BW_SESSION.

This skill is plausibly a Bitwarden CLI helper, but the instructions reference files and conventions that aren't bundled (references/*.md, ./scripts/*.sh) and expect extra tools (docker, mkcert) without declaring them. Before installing or using it: (1) inspect SKILL.md yourself and verify any scripts it references actually exist or are trustworthy; (2) if you test, do so in an isolated environment (not against your real vault) — the skill requires running bw login/unlock which will accept your master password or API key; (3) be cautious with the tmux socket directory (CLAWDBOT_TMUX_SOCKET_DIR) and with captured pane output because those commands can expose secrets to files/terminal history; (4) only install the brew formulas from trusted sources and avoid pasting credentials into chat or logs. If you want me to, I can list the exact lines that reference missing files and undeclared env vars or suggest a minimal safe test plan using a temporary Vaultwarden instance.

Type: OpenClaw Skill Name: openclaw-bitwarden Version: 0.1.0 The OpenClaw Bitwarden skill bundle is benign. It provides instructions and metadata for setting up and using the Bitwarden CLI (`bw`) and `tmux` for session management, which is a legitimate requirement for `BW_SESSION`. The `SKILL.md` file clearly outlines the workflow, common commands, and includes security guardrails (e.g., 'Never paste secrets into logs'). It also details a local testing setup with Vaultwarden, explicitly using local test credentials and `mkcert` for a self-contained environment. There is no evidence of data exfiltration, malicious execution, persistence, or prompt injection attempts to subvert the agent's intended purpose.