--- name: bw-cli description: Securely interact with Bitwarden password manager via the bw CLI. Covers authentication (login/unlock/logout), vault operations (list/get/create/edit/delete items, folders, attachments), password/passphrase generation, organization management, and secure session handling. Use for "bitwarden", "bw", "password safe", "vaultwarden", "vault", "password manager", "generate password", "get password", "unlock vault". Requires bw CLI installed and internet access. --- # Bitwarden CLI Skill Secure vault operations using the Bitwarden command-line interface. ## When to use **Activate this skill when the user wants to:** - Authenticate to Bitwarden (`login`, `unlock`, `logout`, `status`) - Retrieve credentials (`get password`, `get username`, `get totp`, `get item`) - Manage vault items (`list`, `create`, `edit`, `delete`, `restore`) - Generate passwords/passphrases (`generate`) - Handle attachments (`create attachment`, `get attachment`) - Manage organizations (`list organizations`, `move`, `confirm`) - Export/import vault data - Work with Vaultwarden/self-hosted instances **Do NOT use for:** - Installing Bitwarden browser extensions or mobile apps - Comparing password managers theoretically - Self-hosting Bitwarden server setup (use server administration tools) - General encryption questions unrelated to Bitwarden ## Prerequisites - `bw` CLI installed (verify with `bw --version`) - Internet access (or access to self-hosted server) - For vault operations: valid `BW_SESSION` environment variable or interactive unlock ## Authentication & Session Management Bitwarden CLI uses a two-step authentication model: 1. **Login** (`bw login`) - Authenticates identity, creates local vault copy 2. **Unlock** (`bw unlock`) - Decrypts vault, generates session key ### Quick Start: Interactive Login ```bash # Login (supports email/password, API key, or SSO) bw login # Unlock to get session key bw unlock # Copy the export command from output, then: export BW_SESSION="..." ``` ### Automated/Scripted Login Use environment variables for automation: ```bash # Method 1: API Key (recommended for automation) export BW_CLIENTID="user.xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" export BW_CLIENTSECRET="xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" bw login --apikey bw unlock --passwordenv BW_PASSWORD # if BW_PASSWORD set # Method 2: Password file bw unlock --passwordfile ~/.secrets/bw-master-password.txt ``` ### Secure Password Storage (User-Requested) If the user explicitly requests saving the master password to disk for convenience: ```bash # 1. Create secrets directory in workspace mkdir -p ~/.openclaw/workspace/.secrets chmod 700 ~/.openclaw/workspace/.secrets # 2. Store password (user enters interactively) read -s BW_MASTER_PASS echo "$BW_MASTER_PASS" > ~/.openclaw/workspace/.secrets/bw-password.txt chmod 600 ~/.openclaw/workspace/.secrets/bw-password.txt # 3. Ensure git ignores it echo ".secrets/" >> ~/.openclaw/workspace/.gitignore ``` **Security requirements:** - File must be created with mode `600` (user read/write only) - Directory must be mode `700` - Must add `.secrets/` to `.gitignore` immediately - Must inform user of risks ### Check Status ```bash bw status ``` Returns JSON with `status`: `unauthenticated`, `locked`, or `unlocked`. ### End Session ```bash # Lock (keep login, destroy session key) bw lock # Logout (complete logout, requires re-authentication) bw logout # REQUIRES CONFIRMATION ``` ## Core Vault Operations ### List Items ```bash # All items bw list items # Search with filters bw list items --search github bw list items --folderid null --search "api key" bw list items --collectionid xxx --organizationid xxx # Other objects bw list folders bw list organizations bw list collections ``` ### Retrieve Items ```bash # Get specific fields (searches by name if not UUID) bw get password "GitHub" bw get username "GitHub" bw get totp "GitHub" # 2FA code bw get notes "GitHub" bw get uri "GitHub" # Get full item JSON (useful for scripts) bw get item "GitHub" --pretty # By exact ID bw get item 7ac9cae8-5067-4faf-b6ab-acfd00e2c328 ``` **Note:** `get` returns only one result. Use specific search terms. ### Create Items Workflow: template → modify → encode → create ```bash # Create folder bw get template folder | jq '.name="Work Accounts"' | bw encode | bw create folder # Create login item bw get template item | jq \ '.name="New Service" | .login=$(bw get template item.login | jq '.username="user@example.com" | .password="secret123"')' \ | bw encode | bw create item ``` **Item types:** Login (1), Secure Note (2), Card (3), Identity (4). See [references/commands.md](./references/commands.md) for details. ### Edit Items ```bash # Get item, modify password, save back bw get item | jq '.login.password="newpass"' | bw encode | bw edit item # Move to collection echo '["collection-uuid"]' | bw encode | bw edit item-collections --organizationid ``` ### Delete and Restore ```bash # Send to trash (recoverable for 30 days) bw delete item # PERMANENT DELETE - REQUIRES EXPLICIT CONFIRMATION bw delete item --permanent # Restore from trash bw restore item ``` ### Attachments ```bash # Attach file to existing item bw create attachment --file ./document.pdf --itemid # Download attachment bw get attachment document.pdf --itemid --output ./downloads/ ``` ## Password/Passphrase Generation ```bash # Default: 14 chars, upper+lower+numbers bw generate # Custom: 20 chars with special characters bw generate --uppercase --lowercase --number --special --length 20 # Passphrase: 4 words, dash-separated, capitalized bw generate --passphrase --words 4 --separator "-" --capitalize --includeNumber ``` ## Organization Management ```bash # List organizations bw list organizations # List org collections bw list org-collections --organizationid # Move personal item to organization echo '["collection-uuid"]' | bw encode | bw move # Confirm member (verify fingerprint first!) bw get fingerprint bw confirm org-member --organizationid # Device approvals (admin only) bw device-approval list --organizationid bw device-approval approve --organizationid ``` ## Import/Export ```bash # Import from other password managers bw import --formats # list supported formats bw import lastpasscsv ./export.csv # Export vault - REQUIRES CONFIRMATION for destination outside workspace bw export --output ~/.openclaw/workspace/ --format encrypted_json bw export --output ~/.openclaw/workspace/ --format zip # includes attachments ``` ## Self-Hosted / Vaultwarden ```bash # Configure for self-hosted instance bw config server https://vaultwarden.example.com # EU cloud bw config server https://vault.bitwarden.eu # Check current server bw config server ``` ## Safety & Security Guardrails ### Automatic Confirmations Required | Action | Confirmation Required | Reason | |--------|----------------------|--------| | `bw delete --permanent` | Yes | Irreversible data loss | | `bw logout` | Yes | Destroys session, requires re-auth | | `bw export` outside workspace | Yes | Potential data exfiltration | | `bw serve` | Yes | Opens network service | | Saving master password to disk | Yes (with security instructions) | Credential exposure risk | | `sudo` (for installing bw) | Yes | System privilege escalation | ### Secret Handling - **Never log `BW_SESSION`** - redact from all output - **Never log master passwords** - use `--quiet` when piping passwords - **Session keys** - valid until `bw lock` or `bw logout`, or new terminal - **Environment variables** - `BW_PASSWORD`, `BW_CLIENTID`, `BW_CLIENTSECRET` should be unset after use in scripts ### Workspace Boundaries - Default all exports to `~/.openclaw/workspace/` - Create `.secrets/` subdirectory for sensitive files (mode 700) - Auto-add `.secrets/` to `.gitignore` - Confirm before writing outside workspace ## Troubleshooting ### "Your authentication request appears to be coming from a bot" Use API key authentication instead of email/password, or provide `client_secret` when prompted. ### "Vault is locked" Run `bw unlock` and set `BW_SESSION` environment variable. ### Self-signed certificates (self-hosted) ```bash export NODE_EXTRA_CA_CERTS="/path/to/ca-cert.pem" ``` ### Debug mode ```bash export BITWARDENCLI_DEBUG=true ``` ## References - Full command reference: [references/commands.md](./references/commands.md) - Helper scripts: - [scripts/unlock-session.sh](./scripts/unlock-session.sh) - Safe unlock with session export - [scripts/safe-get-field.sh](./scripts/safe-get-field.sh) - Retrieve specific fields safely - [scripts/create-login-item.sh](./scripts/create-login-item.sh) - Interactive login creation --- Source attribution: kbarbel640-del Original project: https://github.com/kbarbel640-del/skills/blob/e7e336ac628c3e3bd771aff1aaa469c93778f94a/skills/0x7466/bw-cli/SKILL.md License: MIT License information: https://opensource.org/license/mit Original upstream instructions; downloaded from Mega AI Hub. ## Upstream license notice MIT License Copyright (c) 2026 clawdbot Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. # Mega AI Hub resource metadata Creator / publisher: kbarbel640-del Original project: https://github.com/kbarbel640-del/skills/blob/e7e336ac628c3e3bd771aff1aaa469c93778f94a/skills/0x7466/bw-cli/SKILL.md Attribution basis: Source repository record Fields of work: Development & Engineering, Sales, Customer Support Roles: Customer Success Manager, Security Engineer, Technical Support Specialties: API Tools: Bitwarden Country applicability: Country not specified Classification basis: Source catalog labels Instruction SHA-256: 2a607dc1c1b70b41dfef29d75e8f8d7f86a29fd37b6ddb6ecccfafb4f4e18fc6