Bitwarden & Vaultwarden

Bitwarden/Vaultwarden CLI (bw) wrapper with automatic login, session caching, and convenient commands. Works seamlessly with both official Bitwarden (vault.bitwarden.com) and self-hosted Vaultwarden instances.

Requirements

• Bitwarden CLI (bw) installed: npm install -g @bitwarden/cli
• A Bitwarden or Vaultwarden server instance
• Credentials configured (see Configuration below)

Configuration

Set credentials via environment variables or a credentials file:

# Environment variables (preferred)
export BW_SERVER="https://vault.bitwarden.com"  # Official Bitwarden
# OR
export BW_SERVER="https://your-vaultwarden-instance.example.com"  # Vaultwarden
export BW_EMAIL="[email protected]"
export BW_MASTER_PASSWORD="your-master-password"

# Or use a credentials file (default: secrets/bitwarden.env)
export CREDS_FILE="/path/to/your/bitwarden.env"

The credentials file should contain:

BW_SERVER=https://vault.bitwarden.com
[email protected]
BW_MASTER_PASSWORD=your-master-password

Invocation

bash skills/bitwarden/bw.sh <command> [args...]

Commands

Workflow

• First call per session: bw.sh login (auto-authenticates from configured credentials)
• Session token cached at /tmp/.bw_session
• All subsequent commands auto-use the cached session
• After reboot/restart: run login again

Storing New Credentials

# Generate + store
PASS=$(bash skills/bitwarden/bw.sh generate 32)
bash skills/bitwarden/bw.sh create "New Service" "[email protected]" "$PASS" "https://service.com"

Account Registration

Register a new account on your Bitwarden/Vaultwarden server directly from the CLI:

# Register using configured credentials (from env/credentials file)
bash skills/bitwarden/bw.sh register

# Register with explicit credentials
bash skills/bitwarden/bw.sh register "[email protected]" "SecurePass123!" "Display Name"

How it works:

• Derives a master key using PBKDF2-SHA256 (600,000 iterations) with the email as salt
• Creates a master password hash for server authentication
• Generates a 64-byte symmetric key, encrypted with AES-256-CBC + HMAC-SHA256
• Submits registration to the server's /api/accounts/register endpoint

Note: The master password must be at least 12 characters. Works with both official Bitwarden and Vaultwarden servers.

Guardrails

• Never paste secrets into logs, chat, or code.
• Keep bitwarden.env out of version control.
• Use chmod 600 on credential files.
• Session tokens are stored in /tmp and cleared on lock/logout.

External Endpoints

Security & Privacy

What leaves your machine:

• Authentication requests (email, master password) to your configured Bitwarden server
• Encrypted vault data (create/read/update/delete operations)
• All communication uses HTTPS/TLS

• Session tokens (cached in /tmp/.bw_session)
• Credential files (if using bitwarden.env)
• Decrypted passwords (only in memory, never written to disk)

Model Invocation

This skill can be invoked autonomously by your OpenClaw agent when it needs to:

• Store credentials securely
• Retrieve passwords for automation tasks
• Generate secure passwords

Security Best Practices

• Credentials file: Use chmod 600 on secrets/bitwarden.env
• Environment isolation: Don't share credential files across systems
• Session tokens: Automatically expire; run bw.sh lock when done
• Git: The .gitignore excludes all secrets (secrets/, *.env, .bw_session)
• Master password: Never hardcode or log your master password