secrets

Secrets Management Skill

Manage credentials securely via Bitwarden. This vault does NOT store credentials - all secrets are kept in Bitwarden and accessed on-demand.

Configuration

By default, secrets are stored in a Bitwarden folder called "Obsidian Vault". You can customise this by setting BITWARDEN_FOLDER in your environment or updating the folder name in the commands below.

Commands

Command	Description
/secrets status	Check Bitwarden CLI status and session
/secrets get <name>	Retrieve a secret by name from Bitwarden
/secrets list	List all secrets in your configured Bitwarden folder
/secrets env	Output export commands for all vault secrets
/secrets setup	Guide through initial Bitwarden CLI setup

---

Implementation

/secrets status

Check Bitwarden CLI installation and session status:

# Check if Bitwarden CLI is installed
if ! command -v bw &> /dev/null; then
    echo "Bitwarden CLI not installed"
    echo "   Install with: brew install bitwarden-cli"
    exit 1
fi

# Check login and lock status
STATUS=$(bw status)
echo "$STATUS" | jq -r '"Status: \(.status)"'

Report to user:

• CLI installed: yes/no
• Logged in: yes/no
• Vault: locked/unlocked
• If not set up, suggest /secrets setup

/secrets get <name>

1. Ensure Bitwarden is unlocked:

   BW_SESSION=$(bw unlock --raw 2>/dev/null)
   if [ -z "$BW_SESSION" ]; then
       echo "Please unlock Bitwarden first: bw unlock"
       exit 1
   fi
   

2. Retrieve the item:

   ITEM=$(bw get item "$SECRET_NAME" --session "$BW_SESSION" 2>/dev/null)
   if [ -z "$ITEM" ]; then
       echo "Secret '$SECRET_NAME' not found"
       exit 1
   fi
   

3. Extract based on type:

   TYPE=$(echo "$ITEM" | jq -r '.type')
   if [ "$TYPE" = "2" ]; then
       # Secure Note - return notes field
       echo "$ITEM" | jq -r '.notes'
   else
       # Login - offer username/password
       echo "Username: $(echo "$ITEM" | jq -r '.login.username')"
       echo "Password: [hidden - use --show-password to display]"
   fi