Securely interact with Bitwarden password manager via the bw CLI. Covers authentication (login/unlock/logout), vault operations (list/get/create/edit/delete items, folders, attachments), password/passphrase generation, organization management, and secure session handling. Use for "bitwarden", "bw", "password safe", "vaultwarden", "vault", "password manager", "generate password", "get password", "unlock vault". Requires bw CLI installed and internet access.
Secure vault operations using the Bitwarden command-line interface.
**Activate this skill when the user wants to:**
**Do NOT use for:**
Bitwarden CLI uses a two-step authentication model:
1. **Login** (`bw login`) - Authenticates identity, creates local vault copy
2. **Unlock** (`bw unlock`) - Decrypts vault, generates session key
```bash
bw login
bw unlock
export BW_SESSION="..."
```
Use environment variables for automation:
```bash
export BW_CLIENTID="user.xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
export BW_CLIENTSECRET="xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
bw login --apikey
bw unlock --passwordenv BW_PASSWORD # if BW_PASSWORD set
bw unlock --passwordfile ~/.secrets/bw-master-password.txt
```
If the user explicitly requests saving the master password to disk for convenience:
```bash
mkdir -p ~/.openclaw/workspace/.secrets
chmod 700 ~/.openclaw/workspace/.secrets
read -s BW_MASTER_PASS
echo "$BW_MASTER_PASS" > ~/.openclaw/workspace/.secrets/bw-password.txt
chmod 600 ~/.openclaw/workspace/.secrets/bw-password.txt
echo ".secrets/" >> ~/.openclaw/workspace/.gitignore
```
**Security requirements:**
```bash
bw status
```
Returns JSON with `status`: `unauthenticated`, `locked`, or `unlocked`.
```bash
bw lock
bw logout
```
```bash
bw list items
bw list items --search github
bw list items --folderid null --search "api key"
bw list items --collectionid xxx --organizationid xxx
bw list folders
bw list organizations
bw list collections
```
```bash
bw get password "GitHub"
bw get username "GitHub"
bw get totp "GitHub" # 2FA code
bw get notes "GitHub"
bw get uri "GitHub"
bw get item "GitHub" --pretty
bw get item 7ac9cae8-5067-4faf-b6ab-acfd00e2c328
```
**Note:** `get` returns only one result. Use specific search terms.
Workflow: template → modify → encode → create
```bash
bw get template folder | jq '.name="Work Accounts"' | bw encode | bw create folder
bw get template item | jq \
'.name="New Service" | .login=$(bw get template item.login | jq '.username="[email protected]" | .password="secret123"')' \
| bw encode | bw create item
```
**Item types:** Login (1), Secure Note (2), Card (3), Identity (4). See [references/commands.md](./references/commands.md) for details.
```bash
bw get item <id> | jq '.login.password="newpass"' | bw encode | bw edit item <id>
echo '["collection-uuid"]' | bw encode | bw edit item-collections <item-id> --organizationid <org-id>
```
```bash
bw delete item <id>
bw delete item <id> --permanent
bw restore item <id>
```
```bash
bw create attachment --file ./document.pdf --itemid <item-id>
bw get attachment document.pdf --itemid <item-id> --output ./downloads/
```
```bash
bw generate
bw generate --uppercase --lowercase --number --special --length 20
bw generate --passphrase --words 4 --separator "-" --capitalize --includeNumber
```
```bash
bw list organizations
bw list org-collections --organizationid <org-id>
echo '["collection-uuid"]' | bw encode | bw move <item-id> <org-id>
bw get fingerprint <user-id>
bw confirm org-member <user-id> --organizationid <org-id>
bw device-approval list --organizationid <org-id>
bw device-approval approve <request-id> --organizationid <org-id>
```
```bash
bw import --formats # list supported formats
bw import lastpasscsv ./export.csv
bw export --output ~/.openclaw/workspace/ --format encrypted_json
bw export --output ~/.openclaw/workspace/ --format zip # includes attachments
```
```bash
bw config server https://vaultwarden.example.com
bw config server https://vault.bitwarden.eu
bw config server
```
| Action | Confirmation Required | Reason |
|--------|----------------------|--------|
| `bw delete --permanent` | Yes | Irreversible data loss |
| `bw logout` | Yes | Destroys session, requires re-auth |
| `bw export` outside workspace | Yes | Potential data exfiltration |
| `bw serve` | Yes | Opens network service |
| Saving master password to disk | Yes (with security instructions) | Credential exposure risk |
| `sudo` (for installing bw) | Yes | System privilege escalation |
Use API key authentication instead of email/password, or provide `client_secret` when prompted.
Run `bw unlock` and set `BW_SESSION` environment variable.
```bash
export NODE_EXTRA_CA_CERTS="/path/to/ca-cert.pem"
```
```bash
export BITWARDENCLI_DEBUG=true
```
- [scripts/unlock-session.sh](./scripts/unlock-session.sh) - Safe unlock with session export
- [scripts/safe-get-field.sh](./scripts/safe-get-field.sh) - Retrieve specific fields safely
- [scripts/create-login-item.sh](./scripts/create-login-item.sh) - Interactive login creation
Leave a review
No reviews yet. Be the first to review this skill!