📦
setup-macbook-productivity
75Set Up Mac Dictation
Mac users may struggle to enable Dictation and its shortcut consistently. This skill applies the supported settings, verifies them, and opens Keyboard settings for approval.
Productivity View
Skills bitwarden-browser-aac-login
📦
bitwarden-browser-aac-login
Content revision r1 High Risk 🌐 Network access⚙️ External commands
Secure Browser Logins with Bitwarden AAC
Browser login automation can expose credentials when agents handle them directly. This skill provides a consent-based Bitwarden Agent Access workflow with domain checks, sanitized status, and explicit trust boundaries.
Supports: Claude Codex Code(CC)
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "bitwarden-browser-aac-login" from https://skillstore.io/skills/arthurzakirov-bitwarden-browser-aac-login.md and its manifest at https://skillstore.io/api/skills/arthurzakirov-bitwarden-browser-aac-login/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "bitwarden-browser-aac-login". The login page is open, but the AAC request was denied.
Expected outcome:
Check that the approved domain exactly matches the target site, that the local listener is unlocked, and that a matching vault item exists. Do not paste the approval token or CLI output.
Using "bitwarden-browser-aac-login". The browser form was filled and the page changed to the account dashboard.
Expected outcome:
- Login completed.
- Verified by the changed page state.
- No credential values were recorded.
Using "bitwarden-browser-aac-login". Should I use the temporary browser bridge for this login?
Expected outcome:
Use manual entry or a credential-blind helper when possible. Use the bridge only after the user understands that credentials pass through agent-controlled memory, with loopback-only binding, no logs, and immediate cleanup.
Security Audit
High Riskv1 • 9/19/2026 Open versioned report
The static findings are false positives: the external-command matches identify Markdown backticks and CLI examples, while the network matches describe loopback or placeholder URLs. The documented bridge still exposes credentials to an agent-controlled child process and browser execution, so publication requires clear user consent and strict handling of the in-memory trust boundary.
3
Files scanned
146
Lines analyzed
0
Review items
0
False positives ignored
Confirmed security concerns (1)
High
Credential Exposure Across Agent-Controlled Bridge
The recommended pattern passes AAC-injected username and password values from a child process to active browser automation. The skill discloses that this is not agent-blind, but the trust boundary still exposes credentials to agent-controlled code in memory.
The documented workflow directly states that `aac run --env-all` supplies credentials to a child helper and that the helper sends them to browser automation. The risk is explicit and supported by both listed files.
Risk Factors
🌐 Network access (4)
Audited by: codex
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/arthurzakirov-bitwarden-browser-aac-login/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/arthurzakirov-bitwarden-browser-aac-login?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/arthurzakirov-bitwarden-browser-aac-login?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/arthurzakirov-bitwarden-browser-aac-login/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/arthurzakirov-bitwarden-browser-aac-login.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
arthurzakirov. (2026). bitwarden-browser-aac-login security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/arthurzakirov-bitwarden-browser-aac-login/audits/1BibTeX citation
@techreport{arthurzakirov-arthurzakirov-bitwarden-browser-aac-login-2026,
author = {arthurzakirov},
title = {bitwarden-browser-aac-login security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/arthurzakirov-bitwarden-browser-aac-login/audits/1},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "bitwarden-browser-aac-login security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
- name: "arthurzakirov"
date-released: "2026-09-19"
url: "https://skillstore.io/skills/arthurzakirov-bitwarden-browser-aac-login/audits/1"
identifiers:
- type: other
value: "skillstore:arthurzakirov-bitwarden-browser-aac-login:audit:1"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 41
Architecture
85
Maintainability
87
Content
65
Community
91
Spec Compliance
What You Can Build
Approve a Website Login
Guide a developer through domain verification, AAC approval, browser form filling, and non-secret success checks.
Design a Credential Bridge
Help an automation engineer evaluate a temporary loopback bridge, cleanup behavior, and the in-memory credential trust boundary.
Document a Safe Login Runbook
Create a support runbook that avoids pasted secrets, explains common AAC failures, and records sanitized outcomes.
Try These Prompts
Explain the Basic Flow
Explain how to use Bitwarden Agent Access for a browser login to example-app.test. List the approval and secret-handling steps.
Prepare a Domain-Scoped Login
Create a step-by-step checklist for logging into example-app.test with `aac listen` and `aac run`. Include only non-secret verification steps.
Troubleshoot a Denied Request
Diagnose an AAC login that reports Request denied. Use domain matching, cached connections, vault item matching, and sanitized status checks.
Review a Credential Bridge
Review this proposed AAC browser-login bridge for trust-boundary risk. Require loopback binding, a random one-use port, no credential logs, timeout cleanup, and explicit user consent.
Best Practices
- Confirm the exact target domain before requesting credentials.
- Report only sanitized status and never print environment values or credential-bearing output.
- Stop for user confirmation before payment, permission grants, or sensitive submission.
Avoid
- Asking users to paste passwords, TOTP codes, tokens, cookies, or rendezvous codes.
- Using broad credential injection without explaining the agent-controlled trust boundary.
- Saving real domains, account identifiers, session values, or credentials in examples.
Frequently Asked Questions
What does this skill control?
It provides guidance for Bitwarden Agent Access and browser login workflows. It does not operate the CLI or browser tool automatically.
Should credentials be pasted into chat?
No. Keep passwords, TOTP codes, API keys, cookies, tokens, and rendezvous codes outside chat.
Why must the domain be confirmed?
Domain confirmation limits the credential request to the website the user expects and helps prevent approval of an unintended site.
What is the temporary bridge?
It is a loopback-only, one-use server that passes credentials in memory from an AAC child process to active browser automation.
Is the bridge fully agent-blind?
No. The browser automation and helper can handle credentials in memory. Prefer manual entry or a credential-blind helper when practical.
How should login success be verified?
Use non-secret page state, such as a changed URL, title, greeting, logout link, or expected next step.
Developer Details
Author
arthurzakirovLicense
MIT
Skillstore revision
r1
Version notice
The author did not declare a version.
Ref
6d1eda2688e9cc52cd39789ce3b30fcb52466b5a
Maintenance freshness
9/19/2026
Usage
0 downloads · 0 views
File structure
More from arthurzakirov
View allRelated Skills
View all📦
agent-browser
74Automate browser workflows with guided sessions
by 101-skills
Manual browser tasks are slow and difficult to repeat. This skill provides session-based commands for consistent navigation, interaction, capture, and verification.
Productivity View
📦
jev-social
70Research Social Posts with Evidence
by socai-io
Social research can be difficult when results lack context, source links, or clear evidence boundaries. Jev Social gathers browser-grounded records from supported platforms and returns a source-linked report.
Research & Learning View
📦
browser-use
38Automate interactive browser tasks with CDP
by browser-use
Web tasks that need clicks, JavaScript rendering, or an existing signed-in session are difficult to handle with simple HTTP requests. This skill controls a CDP-enabled browser and provides workflows for navigation, testing, screenshots, recordings, and cloud browsers.
Productivity View
📦
browser-act-skill-forge
38Forge Reusable Website Automation Skills
by browser-act
Repeated website exploration wastes time and produces fragile automation. This skill inspects browser behavior, verifies extraction or operation paths, and generates reusable Skill packages.
Coding & Development View
📦
firefox-browser
38Automate Firefox with Authenticated Browser Control
by 1jehuang
Authenticated browser workflows are difficult to automate without losing session context. This skill controls a live Firefox profile for navigation, interaction, content capture, JavaScript evaluation, and optional vault-backed login.
Productivity View
📦
browser-mcp-agent
38Control A Real Browser With MCP
by antibrow
Agents often lose login state and get blocked by headless browser signals. This skill gives Claude, Codex, and Claude Code a persistent fingerprinted browser they can drive through MCP tools for authorized workflows.
Productivity View