tbroadley/bitwarden

Bitwarden Vault Access

This skill provides access to the Bitwarden vault via the bw CLI.

Setup Required

Install the CLI:

brew install bitwarden-cli

Login and unlock:

bw login           # One-time login with email + master password
bw unlock          # Returns a BW_SESSION token

Session token must be set as environment variable:

export BW_SESSION="..."

This is configured in ~/.zshrc.local.

When to Use

Use this skill when the user:

• Needs a secret, credential, API key, or password
• Asks to look up something in Bitwarden
• Needs SSH keys, tokens, or other sensitive values
• Is setting up a tool that requires credentials from the vault
• Mentions "Bitwarden" or "vault"

CLI Commands

All commands require the session token. Use --session "$(printenv BW_SESSION)" or rely on the exported env var.

Search for Items

bw list items --search "search term" --session "$(printenv BW_SESSION)" | \
  python3 -c "import sys,json; items=json.load(sys.stdin); [print(f'{i[\"name\"]} (id={i[\"id\"]})') for i in items]"

Get Item Details

bw get item "ITEM_ID" --session "$(printenv BW_SESSION)" | \
  python3 -c "
import sys, json
item = json.load(sys.stdin)
print('Name:', item['name'])
if 'login' in item:
    print('Username:', item['login'].get('username', 'N/A'))
    print('Password:', item['login'].get('password', 'N/A'))
if 'fields' in item:
    for f in item['fields']:
        print(f'Field {f[\"name\"]}:', f.get('value', 'N/A'))
if 'notes' in item and item['notes']:
    print('Notes:', item['notes'])
"

Get Just the Password

bw get password "ITEM_ID" --session "$(printenv BW_SESSION)"

Get Just the Username

bw get username "ITEM_ID" --session "$(printenv BW_SESSION)"

Get a Custom Field

bw get item "ITEM_ID" --session "$(printenv BW_SESSION)" | \
  python3 -c "import sys,json; item=json.load(sys.stdin); print(next(f['value'] for f in item.get('fields',[]) if f['name']=='FIELD_NAME'))"

Get Notes

bw get notes "ITEM_ID" --session "$(printenv BW_SESSION)"

List Items in a Folder

bw list items --folderid "FOLDER_ID" --session "$(printenv BW_SESSION)" | \
  python3 -c "import sys,json; [print(f'{i[\"name\"]} (id={i[\"id\"]})') for i in json.load(sys.stdin)]"

List Folders

bw list folders --session "$(printenv BW_SESSION)" | \
  python3 -c "import sys,json; [print(f'{f[\"name\"]} (id={f[\"id\"]})') for f in json.load(sys.stdin)]"

List Attachments

bw get item "ITEM_ID" --session "$(printenv BW_SESSION)" | \
  python3 -c "import sys,json; item=json.load(sys.stdin); [print(f'{a[\"fileName\"]} (id={a[\"id\"]})') for a in item.get('attachments',[])]"

Download Attachment

bw get attachment "ATTACHMENT_ID" --itemid "ITEM_ID" --output /tmp/attachment --session "$(printenv BW_SESSION)"

Item Types

Bitwarden items have a type field:

• 1 - Login (username/password)
• 2 - Secure Note
• 3 - Card
• 4 - Identity

Common Workflows

Find and Retrieve a Secret

# 1. Search for the item
bw list items --search "spacelift" --session "$(printenv BW_SESSION)" | \
  python3 -c "import sys,json; [print(f'{i[\"name\"]} (id={i[\"id\"]})') for i in json.load(sys.stdin)]"

# 2. Get the full item by ID
bw get item "ITEM_UUID" --session "$(printenv BW_SESSION)" | python3 -c "
import sys, json
item = json.load(sys.stdin)
print('Name:', item['name'])
if 'login' in item:
    print('Username:', item['login'].get('username', 'N/A'))
    print('Password:', item['login'].get('password', 'N/A'))
if 'fields' in item:
    for f in item['fields']:
        print(f'Field {f[\"name\"]}:', f.get('value', 'N/A'))
if 'notes' in item and item['notes']:
    print('Notes:', item['notes'])
"

Export a Secret as Environment Variable

export MY_SECRET="$(bw get password 'ITEM_ID' --session "$(printenv BW_SESSION)")"

Session Management

• Sessions expire after inactivity
• If you get "You are not logged in", the session has expired
• Re-unlock with: bw unlock (user must run interactively)
• bw status --session "$(printenv BW_SESSION)" checks vault status
• bw sync --session "$(printenv BW_SESSION)" fetches latest vault data

Notes

• Always use $(printenv BW_SESSION) to ensure the token expands correctly
• Search is case-insensitive and matches against item names
• Item IDs are UUIDs
• The bw CLI outputs JSON by default, use python3 or jq to parse
• Never log or echo raw secrets to the terminal unnecessarily
• The vault is read-only in typical usage; creating/editing items requires additional permissions