Requirements
- Target platform
- OpenClaw
- Install method
- Manual import
- Extraction
- Extract archive
- Prerequisites
- OpenClaw
- Primary doc
- SKILL.md
Set up and use Bitwarden CLI (bw). Use when installing the CLI, unlocking vault, or reading/generating secrets via bw. Handles session management with BW_SESSION.
Set up and use Bitwarden CLI (bw). Use when installing the CLI, unlocking vault, or reading/generating secrets via bw. Handles session management with BW_SESSION.
Hand the extracted package to your coding agent with a concrete install brief instead of figuring it out manually.
I downloaded a skill package from Yavira. Read SKILL.md from the extracted folder and install it by following the included instructions. Tell me what you changed and call out any manual steps you could not complete.
I downloaded an updated skill package from Yavira. Read SKILL.md from the extracted folder, compare it with my current installation, and upgrade it while preserving any custom configuration unless the package docs explicitly say otherwise. Summarize what changed and any follow-up checks I should run.
Manage passwords and secrets via the Bitwarden CLI.
references/get-started.md (install + login + unlock flow) references/cli-examples.md (real bw examples)
Check CLI present: bw --version. Check login status: bw status (returns JSON with status field). If not logged in: bw login (stores API key, prompts for master password). REQUIRED: create a fresh tmux session for all bw commands. Unlock vault inside tmux: bw unlock (outputs session key). Export session key: export BW_SESSION="<key>". Verify access: bw sync then bw list items --search test.
The Bitwarden CLI requires the BW_SESSION environment variable for authenticated commands. To persist the session across commands, always run bw inside a dedicated tmux session. Example (see tmux skill for socket conventions): SOCKET_DIR="${CLAWDBOT_TMUX_SOCKET_DIR:-${TMPDIR:-/tmp}/openclaw-tmux-sockets}" mkdir -p "$SOCKET_DIR" SOCKET="$SOCKET_DIR/openclaw-bw.sock" SESSION="bw-auth-$(date +%Y%m%d-%H%M%S)" tmux -S "$SOCKET" new -d -s "$SESSION" -n shell # Unlock and capture session key tmux -S "$SOCKET" send-keys -t "$SESSION":0.0 -- 'export BW_SESSION=$(bw unlock --raw)' Enter tmux -S "$SOCKET" send-keys -t "$SESSION":0.0 -- 'bw sync' Enter tmux -S "$SOCKET" send-keys -t "$SESSION":0.0 -- 'bw list items --search github' Enter # Capture output tmux -S "$SOCKET" capture-pane -p -J -t "$SESSION":0.0 -S -200 # Cleanup when done tmux -S "$SOCKET" kill-session -t "$SESSION"
CommandDescriptionbw statusCheck login/lock status (JSON)bw loginLogin with email/password or API keybw unlockUnlock vault, returns session keybw lockLock vaultbw syncSync vault with serverbw list itemsList all itemsbw list items --search <query>Search itemsbw get item <id-or-name>Get specific item (JSON)bw get password <id-or-name>Get just the passwordbw get username <id-or-name>Get just the usernamebw get totp <id-or-name>Get TOTP codebw generate -ulns --length 32Generate password
Never paste secrets into logs, chat, or code. Always use tmux to maintain BW_SESSION across commands. Prefer bw get password over parsing full item JSON when only password needed. If command returns "Vault is locked", re-run bw unlock inside tmux. Do not run authenticated bw commands outside tmux; the session won't persist. Lock vault when done: bw lock.
This skill includes a Docker Compose setup for local testing with Vaultwarden (self-hosted Bitwarden-compatible server).
# Install mkcert and generate local certs (one-time) brew install mkcert mkcert -install cd /path/to/openclaw-bitwarden mkdir -p certs && cd certs mkcert localhost 127.0.0.1 ::1 cd .. # Start Vaultwarden + Caddy docker compose up -d # Configure bw CLI to use local server bw config server https://localhost:8443 # Create a test account via web UI at https://localhost:8443 # Or run the setup script: ./scripts/setup-test-account.sh # Test the skill workflow ./scripts/test-skill-workflow.sh
Server URL: https://localhost:8443 Admin Panel: https://localhost:8443/admin (token: test-admin-token-12345) Suggested test account: test@example.com / TestPassword123!
The bw CLI requires the mkcert CA to be trusted. Export before running bw commands: export NODE_EXTRA_CA_CERTS="$(mkcert -CAROOT)/rootCA.pem" Or add to your shell profile for persistence.
docker compose down -v # Remove container and data
Code helpers, APIs, CLIs, browser automation, testing, and developer operations.
Largest current source with strong distribution and engagement signals.