The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of the bw CLI tool for vault operations. Commands are used for authentication, retrieving secrets, and modifying vault items.
[EXTERNAL_DOWNLOADS]: Instructions include downloading the official Bitwarden CLI via npm (@bitwarden/cli) or Homebrew, or from the official Bitwarden website. These are well-known and reputable sources.
[DATA_EXFILTRATION]: The skill's primary purpose involves handling highly sensitive data, including master passwords, API keys, and vault contents. It provides clear guidance on using environment variables and session keys to minimize exposure, though the agent's access to these secrets represents an inherent data handling risk.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through data stored within the Bitwarden vault (e.g., item names, notes, or fields) that the agent retrieves and processes.
Ingestion points: Data retrieved from the vault via bw get item, bw list items, and other retrieval commands (references/command-cookbook.md).
Boundary markers: No explicit delimiters or warnings are provided to the agent to treat vault content as untrusted data.
Capability inventory: The agent can execute shell commands and interact with the filesystem as documented in SKILL.md and references/command-cookbook.md.
Sanitization: There is no evidence of sanitization or validation of the content retrieved from the vault before it is processed by the agent.

bitwarden-cli