The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the shell to execute the rbw CLI tool for managing Bitwarden vault items. This is the primary intended function of the skill.
[DATA_EXFILTRATION]: While the skill handles sensitive credentials, it incorporates specific instructions to prevent secrets from being piped to network-transmitting commands like curl or wget.
[PROMPT_INJECTION]: The skill includes robust defensive prompts (Security Guardrails) to resist role-play attacks and instructions embedded in untrusted data. These instructions emphasize that the agent should only act on direct user requests for credential operations.
[PROMPT_INJECTION]: Indirect prompt injection surfaces were identified:
Ingestion points: The agent reads output from the rbw CLI and may process external files (like a README.md) mentioned in the documentation.
Boundary markers: Present in SKILL.md as explicit security guardrails that instruct the agent to ignore directives embedded in tool outputs or files.
Capability inventory: Execution of shell commands via exec for vault interactions.
Sanitization: Mandatory user confirmation is required for any vault modification or retrieval operation not explicitly named by the user.
[CREDENTIALS_UNSAFE]: The skill manages credentials but adheres to best practices by forbidding the use of export for storing secrets and advising against literal credential values in command arguments.

bitwarden-hardened