bitwarden-machine-account-ops

Design and operate scoped Bitwarden Secrets Manager machine accounts without leaking credentials. Use when provisioning host, service, CI, or SDK secrets; runtime injection; token rotation or revocation; recovery tests; compromise response; or non-secret contract validation across Windows, WSL, containers, Proxmox guests, and automation.

Quality

85%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

78%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is dense, actionable, and well-sequenced with concrete CLI commands, a decision table, and validation-gated rotation/recovery workflows. Its main defect is referencing two template files that are absent from the bundle, which breaks progressive-disclosure navigation.

Suggestions

Create the missing `templates/secret-contract.md` and `templates/rotation-record.md` (or add a `templates/` directory) so every referenced path resolves, since the body directs the user to use them before approving changes.

Consolidate the repeated prohibited-token-location lists (items 4, 8, and the table) into a single canonical list to reduce redundancy and token cost.

Add an explicit feedback loop for the destructive workflows (e.g., "if validation of the replacement fails, fix the contract/scope and re-validate before revoking the old token") to lift workflow clarity toward 5.

Dimension	Reasoning	Score
Conciseness	Assumes Claude's competence with no concept padding (no "what is Bitwarden" exposition) and high-signal rules, but prohibited token locations are repeated across items 4, 8, and the decision table, leaving minor redundancy that could be trimmed — the 4 anchor fits better than 5.	4 / 5
Actionability	Provides fully executable guidance: concrete commands (`bws run --project-id <id> --no-inherit-env -- <trusted-entrypoint>`, `BWS_ACCESS_TOKEN`, `--uuids-as-keynames`, `scripts/validate_secret_contract.py <completed-contract.md>`) and a need→preferred-decision→prohibited-shortcut table covering common cases, matching the 5 anchor.	5 / 5
Workflow Clarity	Items 9 and 10 give clear sequenced procedures (rotate→validate without output→validate service→revoke; isolate→preserve evidence→validate replacement→revoke→remove state→recovery test) with validation checkpoints, but lack an explicit "if validation fails, retry" feedback loop, fitting 4 rather than 5; destructive ops include validation so the cap-at-3 rule does not apply.	4 / 5
Progressive Disclosure	The overview is well-organized with clearly signaled one-level-deep references and a dedicated "Bundled resources" section, but 2 of 5 referenced paths (`templates/secret-contract.md`, `templates/rotation-record.md`) do not exist in the actual bundle, creating broken navigation that pulls this below the 4 anchor.	3 / 5
	Total	16 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is highly specific, complete, and distinctive, clearly stating both what the skill does and when to use it with a rich set of natural trigger phrases. Its only weakness is a lack of synonym/extension coverage in the trigger terms.

Suggestions

Add a couple of natural synonyms or shorthands users might say (e.g., "bws token", "service-account secrets") to round out trigger-term coverage.

Consider naming the file/CLI artifact users may reference (e.g., "bws" or ".env-free secret provisioning") to improve discoverability.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — "Design and operate scoped...machine accounts", "provisioning host, service, or SDK secrets", "runtime injection", "token rotation or revocation", "recovery tests", "compromise response", "non-secret contract validation" — giving comprehensive coverage with no meaningful gaps, matching the 5 anchor.	5 / 5
Completeness	Explicitly answers both "what" ("Design and operate scoped Bitwarden Secrets Manager machine accounts without leaking credentials") and "when" ("Use when provisioning host, service, or SDK secrets..."), with concrete trigger phrases matching the 5 anchor.	5 / 5
Trigger Term Quality	Strong natural triggers (rotation/revocation, recovery, compromise response, provisioning, runtime injection) a user would actually say, but it omits synonyms and file/extension variants, fitting the 4 "good coverage, a few natural terms missing" anchor rather than 5.	4 / 5
Distinctiveness Conflict Risk	Occupies a clear niche (scoped Bitwarden machine accounts) with distinct, specific triggers and minimal overlap with other skills, matching the 5 anchor; third-person voice is maintained.	5 / 5
	Total	19 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: pvnkmnk/AgenticSelfHostSkills
Path: skills/bitwarden-machine-account-ops/SKILL.md
Commit: 0f62e6b

Reviewed: 4 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.