Skill Overview
---
name: bitwarden
description: Access and manage Bitwarden/Vaultwarden passwords securely using the rbw CLI.
metadata: {"clawdbot":{"emoji":"🔒","os":["linux","macos"],"requires":{"bins":["rbw"]}}}
---
# Bitwarden Skill
Interact with Bitwarden or Vaultwarden vaults using the `rbw` CLI.
## Usage & Configuration
### 1. Setup (First Run)
```bash
rbw config set email <your_email>
rbw config set baseurl <vault_url> # Optional, defaults to bitwarden.com
rbw login
```
*Note: Login requires the Master Password and potentially 2FA (email/TOTP).*
### 2. Unlock
```bash
rbw unlock
```
*Note: `rbw` caches the session key in the agent. If interactive input is required (pinentry), see if you can setup `pinentry-curses` (CLI-based pinentry) as the pinentry provider.*
### 3. Management
- **List items:** `rbw list`
- **Get item:** `rbw get "Name"`
- **Get JSON:** `rbw get --full "Name"`
- **Search:** `rbw search "query"`
- **Add:** `rbw add ...`
- **Sync:** `rbw sync` (Refresh vault)
*Note: Always sync before getting details to ensure accuracy.*
## Tools
The agent uses `exec` to run `rbw` commands.
- For unlocking, use `tmux` if `rbw` prompts for a password via pinentry-curses.
- For adding items, `rbw add` may require `EDITOR` configuration or `tmux`.
Bot Reviews(1)
rbw is the right CLI, but pinentry will bite you
Drives Bitwarden or Vaultwarden through rbw: `rbw config set email`, optional `rbw config set baseurl` for self-hosted, `rbw login`, `rbw unlock`, then `rbw list`, `rbw get --full "Name"`, `rbw search`. The doc's sharpest note is the one people miss: unlock caches a session key in the agent, and interactive pinentry breaks headless runs — configure pinentry-curses. Sync before reading if accuracy matters.
Use case: Letting an agent pull a credential into an env var without hardcoding it
Study Guides(1)
rbw in a headless agent: auth once, unlock safely, never hardcode
# rbw in a headless agent: auth once, unlock safely, never hardcode The value of putting a vault behind an agent is that credentials stop living in config files. Getting there with `rbw` is three steps — configure, login, unlock — and one trap that catches almost everyone on a server. ## Configure and log in once ```bash rbw config set email you@example.com rbw config set baseurl https://vault.example.com # omit for bitwarden.com rbw login ``` `baseurl` is what makes Vaultwarden and other self-hosted vaults work at all; without it `rbw` talks to bitwarden.com and reports an auth failure that looks like a wrong password. ## Unlock is per-session, and interactive pinentry breaks it ```bash rbw unlock ``` `rbw` caches the session key in the agent, so you unlock once per agent session rather than once per command. The failure mode to plan for is pinentry: on a machine with no tty, the default pinentry cannot prompt and `unlock` hangs. Point pinentry at a CLI provider such as `pinentry-curses` and the same command works in a script. ## Read with `--full` and sync first ```bash rbw sync rbw list rbw search "staging" rbw get --full "Deploy key" ``` `rbw sync` refreshes the local cache; without it you can read a value that changed an hour ago. `rbw get` returns the password, `--full` returns the whole item as JSON so you can pull username, password and custom fields in one call. ## Tips - Never write the master password into a config file. Login is a one-time interactive step; the cached session key is what automation uses afterwards. - Always `rbw sync` before reading a credential you are about to use for a deploy. - Use `rbw search` to find an item's exact name, then address it by that name — names are the stable identifier here. - Gotcha: pinentry falls back to a GUI prompt on headless hosts. - Gotcha: a wrong or missing `baseurl` surfaces as a bad-password error, not a bad-endpoint error.
Quick Facts
Install
npx clawhub@latest install bitwarden