agentleFS
Sign inStart free
domvoxdomvox/hermes-skills/bitwarden/SKILL.md

bitwarden

Skill13 starsChanged 7 months agoMITView on GitHub

Set up and use Bitwarden Secrets Manager CLI (bws). Use when reading, listing, or injecting secrets into env vars and dotenv files.

  • Reads credentials

2 other projects use a version of this.

Adopted by

Most recently taken up by

  • Other versions2 projects use a version of this.

    Word for word · 0

    None found.

    Edited · 0

    None found.

    Wrote their own version · 2

    1. pjmuller/skills★ 2same name
    2. jp4g/claude-skills★ 0same name

    How matches are found. Word for word: the exact same text. Edited: shares passages with this file (“99% same” means 99% of its five-word phrases also appear here; 10% or more counts). Their own version: similar meaning, or, weakest, the same name. We can’t tell which project had it first. Projects are counted among the 200 most-starred candidates, and mentions are links to the repository we found, up to 50 per site, so both counts are a floor.

  • In this repository3 other files it gives its agents.

The file

We split this skill into the rules it gives an agent

7 rules. About 0 are common, 4 are distinctive, and 3 are very specific to this project.

  • ≈0

    Common · estimate

    Many files like this have a rule of this kind.

  • ≈4

    Distinctive · estimate

    This author's own choices. Worth a look.

  • 3

    Very specific

    Tied to their project's names, files or tools. Probably skip.

  • Common
  • Distinctive
  • Very specific
  1. Distinctive:

    Use this skill when the user wants secrets managed through Bitwarden Secrets Manager instead of plaintext env vars or files.

    line 30
  2. Distinctive:

    Read secrets from Bitwarden Secrets Manager

    line 50
  3. Distinctive:

    Run commands with secrets injected as env vars

    line 52
  4. Distinctive:

    Never print raw secret values back to user unless they explicitly request the value.

    line 105
  5. Very specific:

    Prefer bws run for injecting secrets into commands.

    line 106
  6. Very specific:

    If a secret is needed once, use bws run — do not write to disk.

    line 107
  7. Very specific:

    When possible, use a single bws run call instead of multiple bws secret get calls.

    line 118

≈ “Common” is an estimate: at least 1 in 5 of the 350,495 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.

Keep what fits and drop the rest. Your version, ready for your agents.
Files
SKILL.md

Bitwarden Secrets Manager CLI

Use this skill when the user wants secrets managed through Bitwarden Secrets Manager instead of plaintext env vars or files.

Requirements

  • Bitwarden organization with Secrets Manager enabled
  • bws CLI installed
  • Machine account access token (BWS_ACCESS_TOKEN)

Installation

# Download from https://github.com/bitwarden/sdk-sm/releases
# Find the latest bws-vX.Y.Z release, download the linux-x64 archive
unzip bws-*.zip
install bws ~/.local/bin/bws
bws --version  # verify

When to Use

  • Read secrets from Bitwarden Secrets Manager
  • List secrets in a project
  • Run commands with secrets injected as env vars
  • Export secrets to dotenv format

Authentication

Set BWS_ACCESS_TOKEN in the Hermes .env file (the skill will prompt for this on first load).

bws is fully stateless — each call authenticates via the env var. No session management, no signin flow, no tmux workaround needed.

export BWS_ACCESS_TOKEN="0.your-token-here"
bws secret list  # verify — should list secrets

Common Operations

Run a command with secrets injected

Preferred method — bws run injects all accessible secrets as env vars:

bws run -- 'echo $SECRET_NAME'
bws run --project-id <id> -- 'npm run start'
bws run --no-inherit-env -- './my-script.sh'  # clean env, secrets only

Secret key names become env var names. If keys are not POSIX-compliant (spaces, special chars), use --uuids-as-keynames to use secret UUIDs instead.

List secrets

bws secret list
bws secret list <project-id>

Read a single secret by ID

bws secret get <secret-id>

Export secrets to dotenv format

bws secret list --output env > /tmp/secrets.env

Output formats

bws supports --output with: json (default), yaml, table, tsv, env, none.

Guardrails

  • Never print raw secret values back to user unless they explicitly request the value.
  • Prefer bws run for injecting secrets into commands. Use dotenv export only for bulk sync.
  • If a secret is needed once, use bws run — do not write to disk.
  • Manage secrets (create/update/delete) through the Bitwarden web vault, not CLI. The CLI supports these operations but vault provides audit trail and approval flow.

Performance Note

Multiple rapid bws calls may hit rate limits. To reduce this, enable state files which cache auth tokens:

bws config state-dir ~/.config/bws/state

When possible, use a single bws run call instead of multiple bws secret get calls.

Troubleshooting

  • Missing access token → BWS_ACCESS_TOKEN not exported or empty.
  • bws: command not found → binary not in PATH. Check ~/.local/bin/ or /usr/local/bin/.
  • Unauthorized → token expired or revoked. Regenerate in Bitwarden web vault.
  • Empty output from bws secret list → machine account has no project access. Check vault permissions.
  • Non-POSIX key names in bws run → use --uuids-as-keynames flag.

References

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

No reviews yet

People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.

  • It worked
  • Partly
  • It didn't
What did you use it for? e.g. Reviewing pull requests in a Rails app

Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free