المهارات bitwarden-browser-aac-login
📦

bitwarden-browser-aac-login

مراجعة المحتوى r1 مخاطر عالية 🌐 الوصول إلى الشبكة⚙️ الأوامر الخارجية

Secure Browser Logins with Bitwarden AAC

Browser login automation can expose credentials when agents handle them directly. This skill provides a consent-based Bitwarden Agent Access workflow with domain checks, sanitized status, and explicit trust boundaries.

يدعم: Claude Codex Code(CC)
⚠️ 38 ضعيف

التثبيت باستخدام Agent لدي

انسخ هذا الطلب إلى Agent لديك. يتضمن صفحة Skill المعتمدة وملف manifest.

طلب الوكيل
Review the Skillstore skill "bitwarden-browser-aac-login" from https://skillstore.io/skills/arthurzakirov-bitwarden-browser-aac-login.md and its manifest at https://skillstore.io/api/skills/arthurzakirov-bitwarden-browser-aac-login/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

يجب أن يواصل Agent عرض خطته وطلب أي تأكيد تفرضه سياسة الأمان.

موارد مهيّأة لـ Agents

استخدم هذه الروابط عندما يحتاج AI Agent أو crawler أو script إلى سياق نظيف بدلًا من قراءة الصفحة كاملة.

تفاصيل Markdown GET /skills/arthurzakirov-bitwarden-browser-aac-login.md manifest موقَّع GET /api/skills/arthurzakirov-bitwarden-browser-aac-login/manifest lockfile موقَّع GET /api/skills/arthurzakirov-bitwarden-browser-aac-login/lockfile

اختبرها

جارٍ استخدام "bitwarden-browser-aac-login". The login page is open, but the AAC request was denied.

النتيجة المتوقعة:

Check that the approved domain exactly matches the target site, that the local listener is unlocked, and that a matching vault item exists. Do not paste the approval token or CLI output.

جارٍ استخدام "bitwarden-browser-aac-login". The browser form was filled and the page changed to the account dashboard.

النتيجة المتوقعة:

  • Login completed.
  • Verified by the changed page state.
  • No credential values were recorded.

جارٍ استخدام "bitwarden-browser-aac-login". Should I use the temporary browser bridge for this login?

النتيجة المتوقعة:

Use manual entry or a credential-blind helper when possible. Use the bridge only after the user understands that credentials pass through agent-controlled memory, with loopback-only binding, no logs, and immediate cleanup.

التدقيق الأمني

مخاطر عالية
v1 • ١٩‏/٩‏/٢٠٢٦ فتح التقرير المرتبط بالإصدار

The static findings are false positives: the external-command matches identify Markdown backticks and CLI examples, while the network matches describe loopback or placeholder URLs. The documented bridge still exposes credentials to an agent-controlled child process and browser execution, so publication requires clear user consent and strict handling of the in-memory trust boundary.

3
الملفات التي تم فحصها
146
الأسطر التي تم تحليلها
0
عناصر المراجعة
0
تم تجاهل الإيجابيات الكاذبة

مخاوف أمنية مؤكدة (1)

مرتفع
SKILL.md:42-48references/browser-bridge.md:6-17
Credential Exposure Across Agent-Controlled Bridge
The recommended pattern passes AAC-injected username and password values from a child process to active browser automation. The skill discloses that this is not agent-blind, but the trust boundary still exposes credentials to agent-controlled code in memory.
The documented workflow directly states that `aac run --env-all` supplies credentials to a child helper and that the helper sends them to browser automation. The risk is explicit and supported by both listed files.

عوامل الخطر

🌐 الوصول إلى الشبكة (4)
references/browser-bridge.md:31 SKILL.md:30 SKILL.md:64 SKILL.md:45
⚙️ الأوامر الخارجية (19)
SKILL.md:3 SKILL.md:13 SKILL.md:14 SKILL.md:23-26 SKILL.md:26-30 SKILL.md:30-34 SKILL.md:34 SKILL.md:42-45 SKILL.md:45-46 SKILL.md:46-47 SKILL.md:47 SKILL.md:50-54 SKILL.md:54 SKILL.md:55-63 SKILL.md:63-64 SKILL.md:64-65 SKILL.md:65-66 SKILL.md:66-67 SKILL.md:67-68
دقّقه: codex
شارك واستشهد بهذا التقرير

شارك تقرير التقييم المرتبط بالإصدار والشارة المحايدة وبطاقة التضمين والاستشهادات. تعرض Skillstore الأدلة من دون أن تقرر ما إذا كانت هذه المهارة آمنة.

فتح التقرير المرتبط بالإصدار
تقييم الأمان

نسخ رابط التقرير

https://skillstore.io/skills/arthurzakirov-bitwarden-browser-aac-login/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

شارة Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/arthurzakirov-bitwarden-browser-aac-login/security.svg)](https://skillstore.io/skills/arthurzakirov-bitwarden-browser-aac-login?utm_source=security_passport_badge)

شارة HTML

<a href="https://skillstore.io/skills/arthurzakirov-bitwarden-browser-aac-login?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/arthurzakirov-bitwarden-browser-aac-login/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

بطاقة قابلة للتضمين

<iframe src="https://skillstore.io/embed/skills/arthurzakirov-bitwarden-browser-aac-login.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
الاستشهادات الأكاديمية (APA · BibTeX · CFF)

اقتباس APA

arthurzakirov. (2026). bitwarden-browser-aac-login security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/arthurzakirov-bitwarden-browser-aac-login/audits/1

اقتباس BibTeX

@techreport{arthurzakirov-arthurzakirov-bitwarden-browser-aac-login-2026, author = {arthurzakirov}, title = {bitwarden-browser-aac-login security audit report (audit version 1)}, institution = {Skillstore}, year = {2026}, number = {1}, url = {https://skillstore.io/skills/arthurzakirov-bitwarden-browser-aac-login/audits/1}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "bitwarden-browser-aac-login security audit report (audit version 1)" version: "unspecified" type: report authors: - name: "arthurzakirov" date-released: "2026-09-19" url: "https://skillstore.io/skills/arthurzakirov-bitwarden-browser-aac-login/audits/1" identifiers: - type: other value: "skillstore:arthurzakirov-bitwarden-browser-aac-login:audit:1" description: "Skillstore immutable audit report identifier"

تقييم Skillstore

سبب هذا التقييم موثوقية الأدلة: متوسط
41
الهندسة المعمارية
85
قابلية الصيانة
87
المحتوى
65
المجتمع
91
الامتثال للمواصفات

ما الذي يمكنك بناؤه

Approve a Website Login

Guide a developer through domain verification, AAC approval, browser form filling, and non-secret success checks.

Design a Credential Bridge

Help an automation engineer evaluate a temporary loopback bridge, cleanup behavior, and the in-memory credential trust boundary.

Document a Safe Login Runbook

Create a support runbook that avoids pasted secrets, explains common AAC failures, and records sanitized outcomes.

جرّب هذه الموجّهات

Explain the Basic Flow 
Explain how to use Bitwarden Agent Access for a browser login to example-app.test. List the approval and secret-handling steps.
Prepare a Domain-Scoped Login 
Create a step-by-step checklist for logging into example-app.test with `aac listen` and `aac run`. Include only non-secret verification steps.
Troubleshoot a Denied Request 
Diagnose an AAC login that reports Request denied. Use domain matching, cached connections, vault item matching, and sanitized status checks.
Review a Credential Bridge 
Review this proposed AAC browser-login bridge for trust-boundary risk. Require loopback binding, a random one-use port, no credential logs, timeout cleanup, and explicit user consent.

أفضل الممارسات

  • Confirm the exact target domain before requesting credentials.
  • Report only sanitized status and never print environment values or credential-bearing output.
  • Stop for user confirmation before payment, permission grants, or sensitive submission.

تجنب

  • Asking users to paste passwords, TOTP codes, tokens, cookies, or rendezvous codes.
  • Using broad credential injection without explaining the agent-controlled trust boundary.
  • Saving real domains, account identifiers, session values, or credentials in examples.

الأسئلة المتكررة

What does this skill control?
It provides guidance for Bitwarden Agent Access and browser login workflows. It does not operate the CLI or browser tool automatically.
Should credentials be pasted into chat?
No. Keep passwords, TOTP codes, API keys, cookies, tokens, and rendezvous codes outside chat.
Why must the domain be confirmed?
Domain confirmation limits the credential request to the website the user expects and helps prevent approval of an unintended site.
What is the temporary bridge?
It is a loopback-only, one-use server that passes credentials in memory from an AAC child process to active browser automation.
Is the bridge fully agent-blind?
No. The browser automation and helper can handle credentials in memory. Prefer manual entry or a credential-blind helper when practical.
How should login success be verified?
Use non-secret page state, such as a changed URL, title, greeting, logout link, or expected next step.

تفاصيل المطور

المؤلف

arthurzakirov

الترخيص

MIT

مراجعة Skillstore

r1

تنبيه الإصدار

لم يعلن المؤلف عن إصدار.

المستودع

https://github.com/arthurzakirov/agentdesk/tree/1a84d5397e3ecc84eae868f1be6102d527c7f51e/skills/bitwarden-browser-aac-login

مرجع

6d1eda2688e9cc52cd39789ce3b30fcb52466b5a

حداثة الصيانة

١٩‏/٩‏/٢٠٢٦

الاستخدام

0 تنزيلات · 0 مشاهدات

بنية الملفات

📁 agents/

📄 openai.yaml

📁 references/

📄 browser-bridge.md

📄 SKILL.md

المزيد من arthurzakirov

عرض الكل

مهارات ذات صلة

عرض الكل
📦

browser-act-skill-forge

38

صياغة مهارات أتمتة المتصفح

بواسطة browser-act

غالبا ما تكرر الفرق استكشاف المتصفح الهش عندما تحتاج إلى بيانات الويب أو سير عمل الحسابات. تساعد هذه المهارة Claude وCodex وClaude Code على الاستكشاف مرة واحدة، والتحقق من الطرق، وتجميع مهارات browser-act قابلة لإعادة الاستخدام.

البرمجة والتطوير عرض