bitwarden-cli
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external Bitwarden vaults which represents a potential attack surface for indirect prompt injection.
- Ingestion points: Data from the vault is brought into the agent's context through commands like
bw listandbw get itemas specified inSKILL.md. - Boundary markers: The skill lacks explicit instructions to treat vault content (such as the 'notes' field or item names) as untrusted data or to ignore any instructions embedded within that content.
- Capability inventory: The skill grants the agent capabilities to modify vault content (
bw create,bw edit), interact with the Bitwarden API (bw sync), and execute shell commands (jq,bw). - Sanitization: No mechanisms are described for sanitizing or validating the data retrieved from the vault before the agent processes or acts upon it.
Audit Metadata