bitwarden/ai-plugins
47 skills2.3k installs6.1k starsGitHub
Install
npx skills add https://github.com/bitwarden/ai-pluginsSkills in this repo
1RetrospectingThis skill performs a retrospective on a Claude Code session, collecting data from git history, conversation logs, code changes, and user feedback. It sizes the session and picks a Quick, Standard, or Comprehensive analysis depth, then computes metrics and identifies successful and problematic patterns. A developer uses it to review a working session and extract insights for continuous improvement. It produces a structured retrospective report from standardized templates.95installs2Reviewing Security ArchitectureThis skill evaluates a system's security architecture across authentication, authorization, data protection, and trust boundaries. A developer or security engineer uses it to review token handling, session management, credential hashing, RBAC and object-level authorization, encryption choices, and where data crosses trust boundaries. Each area contrasts a secure pattern against a named anti-pattern, with concrete C# examples.89installs3Avoiding False PositivesThis skill validates code review findings and drops false positives. For each finding it runs rejection criteria (pre-existing, pedantic, linter-catchable, generic, handled elsewhere) and three verification checks, dropping any finding that fails. It also lists patterns not to flag, like framework conventions, test code, and lock-file churn. A developer uses it to keep automated or AI-assisted code reviews from surfacing noise.86installs4Threat ModelingThis skill produces threat-model artifacts for new features or architecture changes. A developer uses it to create data flow diagrams, write security definitions (threat model plus security goals), and identify threats with STRIDE during an initial security assessment. It includes scoping rules such as pruning dominated threats, including honest-but-curious passive observers, and reality-checking goals against the runtime.83installs5Classifying Review FindingsThis skill categorizes code review findings into severity levels for PR comments. It maps each finding to one of five categories (CRITICAL, IMPORTANT, DEBT, SUGGESTED, QUESTION) with an emoji and criteria, requires three verification checks before classifying, and rejects non-findings like praise, style preferences, and naming nitpicks. A developer uses it to consistently label and prioritize review findings when commenting on a PR.80installs6Posting Review SummaryThis skill posts the final summary comment as the last step of a code review, after all inline comments are complete. It detects the context (agent-mode sticky comment, GitHub Actions MCP tool, or local file) and routes the summary output accordingly. A developer uses it to produce an overall APPROVE or REQUEST CHANGES assessment with findings grouped by severity and an optional dependency-changes table. It enforces strict rules on what belongs in the summary versus inline comments.79installs7Reviewing Claude ConfigThis skill reviews Claude configuration files (CLAUDE.md, SKILL.md skills, agents, prompts, commands, and settings) for security, structure, and prompt-engineering quality. It detects the file type, always runs a security scan for committed settings.local.json and hardcoded secrets, then loads a matching checklist and documents findings as inline comments. A developer uses it when reviewing changes to Claude tooling files. It validates YAML frontmatter, progressive disclosure, token efficiency, and file references.79installs8Analyzing Code SecurityThis skill runs a manual security code review against OWASP Top 10, API Top 10, Mobile Top 10, and CWE/SANS frameworks. It identifies the attack surface, traces untrusted data from sources to sinks, checks trust boundary crossings, and maps every finding to a specific CWE ID with the exploitable data flow. A developer uses it to find injection, access control, XSS, SSRF, and similar vulnerabilities in code under review.77installs9Analyzing Git SessionsThis skill analyzes git commits and changes within a timeframe or commit range and produces a structured summary. It extracts commit history, generates insertion/deletion statistics, categorizes new and deleted files, and optionally shows selective diffs at Concise, Detailed, or Code Review depth. A developer uses it for code review prep, retrospectives, work logs, or session documentation.74installs10Extracting Session DataThis skill provides raw access to Claude Code native session logs stored as JSONL files. A developer or a calling skill uses it to locate log paths, list sessions with metadata, filter sessions by date, branch, size, or keyword, and extract data types like user prompts, tool usage, errors, and statistics. It returns raw data for the caller to analyze and is designed for context efficiency using bash processing rather than the Read tool.74installs11Detecting SecretsThis skill finds hardcoded secrets and credential leaks in a codebase. A developer uses it to audit for API keys, connection strings, private keys, and tokens, review secret-scanning alerts, and remediate exposed secrets. It applies context-aware detection to filter out test fixtures and placeholders, checks common hiding spots, and follows a rotate-then-remove remediation sequence.73installs12Posting Bitwarden Review CommentsThis skill formats and posts inline code-review comments to GitHub pull requests following Bitwarden engineering standards. Each comment references specific lines, states the problem, gives an actionable fix, and uses severity emojis with collapsed details for longer notes. A developer uses it after findings are classified and ready to post. It forbids praise-only comments and the # symbol, which GitHub would autolink to unrelated issues. Summary comments route to the posting-review-summary skill.72installs13Reviewing DependenciesThis skill walks through auditing third-party dependencies for known vulnerabilities and supply-chain risk. A developer uses it to pull open Dependabot alerts, run Grype scans, and judge whether a vulnerable code path is reachable before deciding to update, work around, or replace a package. It covers npm and .NET (NuGet) tooling plus a dependency-health scorecard for adopt-or-keep decisions.67installs14Bitwarden Security ContextThis skill is a quick-reference for Bitwarden's foundational security framework: the six security principles P01-P06, standard security vocabulary, and data classification standards. It defines guarantees like zero-knowledge servers, locked-vault security, and minimized breach impact, plus terms like protected data and trust boundaries. A developer uses it to get security context for development, code review, or security analysis without loading the full threat-modeling skills.64installs15Triaging Security FindingsThis skill triages security findings from code and dependency scanners. A developer uses it to query GitHub Advanced Security code-scanning, Dependabot, and secret-scanning alerts, interpret Checkmarx and SonarCloud results, and set the correct finding state or dismiss false positives with documented rationale. It covers the Checkmarx, SonarCloud, and Grype scanner landscape and a data-flow-based false-positive protocol.64installs16Perform Security ReviewThis skill performs a security-focused code review by launching four parallel specialized agents plus a verification agent for comprehensive coverage and accurate findings. It resolves the review mode (PR, commit, time-window, local changes, or branch comparison), saves the diff, and pre-fetches code-scanning, secret-scanning, and Dependabot evidence via gh api. A developer uses it to run a comprehensive security audit across code, dependencies, secrets, and configuration. Output can route to chat, a file, or GitHub.52installs17Reviewing Dependency ChangesThis skill reviews the dependency changes inside a pull request diff. A code reviewer uses it when a manifest file like package.json, Cargo.toml, or go.mod changes, to check whether new dependencies followed the AppSec approval process, whether major version bumps were evaluated, and whether lock files stayed in sync. It explicitly defers deep security and license analysis to the separate reviewing-dependencies skill.49installs18Architecting SolutionsThis skill is a framework for architecting solutions inside a team's domain while staying coherent with Bitwarden's holistic architecture. It applies a security-first mindset, maps blast radius across clients and services, weighs architectural trade-offs, and encodes Bitwarden constraints like the V +/- 2 version matrix and dual data-access parity. A developer uses it when planning a solution, assessing blast radius, or deciding whether a choice needs architecture-group input.48installs19Researching Jira IssuesThis skill researches a Jira issue in depth, gathering the main issue, its linked issues, sub-tasks, blocked dependencies, and supporting Confluence documentation. It traverses links up to two levels with priority ordering, rate limiting, and cycle detection, then synthesizes the results into a coherent understanding rather than concatenating raw tool output. A developer uses it when they need real context on an issue before working on it. Failures are handled gracefully and reported.48installs20Workflow AuditThis skill runs the Bitwarden workflow linter (bwwl) against GitHub Actions workflow files in one or more repositories and reports what it finds. It is read-only and does not change any files. A developer uses it to audit .github/workflows/ for lint rule violations, then categorizes each finding as mechanical or judgment so the workflow-fix skill can apply corrections.47installs21Action RemediateThis skill remediates GitHub Actions findings identified by the action-audit skill. It applies the right fix per action type (a @main ref for internal bitwarden actions, a full SHA with version comment for external actions, or a full replacement) across selected repos and opens draft PRs. It shows a diff and asks for confirmation before every commit.46installs22Workflow FixThis skill applies fixes for GitHub Actions workflow linter findings that the workflow-audit skill identified. It applies mechanical fixes automatically, pauses to ask the user on judgment calls, re-runs the linter to verify, and creates draft pull requests. It only edits files under .github/ and shows a diff before every commit.46installs23Action AuditThis skill audits GitHub Actions usage across an org. In incident mode it searches for a specific compromised or deprecated action; in audit mode it sweeps all workflow files for non-compliant references. It produces a read-only report of pin status, resolved SHAs, and compliance, and does not modify any files.45installs24Bitwarden Workflow Linter RulesThis skill is a reference for all 10 Bitwarden workflow linter (bwwl) rules for GitHub Actions workflows. It splits rules into seven mechanical ones that can be applied automatically (like name_capitalized, permissions_exist, pinned_job_runner, step_pinned) and three judgment rules requiring user input. Each rule includes its trigger and fix procedure. A developer uses it to audit and fix CI workflow files against Bitwarden's linting standards.45installs25Committing ChangesThis skill defines git commit conventions and workflow for Bitwarden repositories. It specifies a commit message format with a [PM-XXXXX] Jira ticket prefix, a conventional type keyword, and an optional body, plus rules for follow-up commits and a pre-commit quality gate. A developer uses it when committing code, writing commit messages, or preparing changes for commit in a Bitwarden repo.40installs26Addressing Code Review CommentsThis skill guides Claude through addressing pull request review comments locally. It reads the full set of reviewer feedback from three GitHub API endpoints, restates and verifies each comment against the codebase, then presents fixes, pushback, or clarifications for the developer to decide on. A developer uses it when handling reviewer feedback on a PR and wants technical rigor rather than blind implementation.39installs27Perform PreflightThis skill is a preflight quality-gate checklist to run before committing or creating a PR. It walks through tests, code quality (lint and format), Bitwarden zero-knowledge security checks, and architecture conformance, consulting the repo's CLAUDE.md for the exact commands. A developer uses it to self-review finished work before it goes into version control. On failure it directs the developer to fix the root cause rather than skip the check.39installs28Performing Multi Agent Code ReviewThis skill performs a structured multi-agent code review, launching parallel subagents for quality, security, and architecture-compliance analysis, then validating findings and auditing severity. A developer uses it when they want a deep, thorough review with confidence-scored findings rather than a single-agent pass. It also runs across a commit range, time window, or N most recent commits in a checked-out repo. It depends on the bitwarden-tech-lead and bitwarden-security-engineer sibling plugins.35installs29Running A Proof Of ConceptThis skill is a Proof-of-Concept phase playbook for an initiative shepherd who has an approved recommendation and needs to validate it in real Bitwarden code. It covers picking a representative but contained PoC area, building production-quality scaffolding and 1-3 example implementations, and drafting an ADR. The aim is to surface friction the assessment could not predict before scoping the full rollout.34installs30Championing A Strategy IdeaThis skill is a Primary-Owner playbook for shepherding a Technical Strategy Idea (TSI) through Bitwarden Architecture's pre-funnel evaluation into the Software Initiative Funnel. It covers filing the ARCH idea, pairing with a peer reviewer, completing the Stakeholder & Engagement Map gate, presenting at Architecture Council, and running the Adoption Retrospective. A developer uses it when driving a specific strategy idea as its named Primary Owner.33installs31Contributing To Technical StrategyThis skill guides a tech lead through Bitwarden's technical strategy funnel: recognizing a cross-team pattern of pain, framing it as a Technical Strategy Idea for Architecture to evaluate, tracing how an approved idea becomes a BW Initiative, and breaking epic and story work down onto a team. A developer uses it when a recurring problem exceeds one team's scope or when connecting an initiative back to its originating idea. It relies on the Atlassian tools to read the canonical Jira and Confluence sources.33installs32Coordinating Implementation Across TeamsThis skill is a Phase 5 implementation playbook for an initiative shepherd coordinating multiple teams during active execution. A developer uses it to set up communication channels, run a kickoff, review early PRs only for approach consistency, troubleshoot issues, and unblock cross-team dependencies. It stresses that the shepherd enables teams and keeps leadership informed rather than doing the implementation or detailed code review.33installs33Curating The Strategy Ideas BacklogThis skill is the peer-reviewer and portfolio-curator playbook for Bitwarden's Technical Strategy Ideas backlog. A developer uses it when peer-reviewing someone else's idea or stewarding the ARCH idea portfolio through triage, monthly RICE scoring, roadmap placement, and quarterly prioritization. It defines the constructive-challenge role, the Stakeholder & Engagement Map gate, and the handoff of approved ideas to the funnel.33installs34Navigating The Initiative FunnelThis skill is a playbook for a tech lead participating in Bitwarden's Software Initiative Funnel, a five-phase process for cross-cutting technical work. It clarifies who owns what between the initiative shepherd and the tech lead through Identification, Research, Proof of Concept, Scoping & Commitment, and Implementation. A tech lead uses it when receiving an initiative epic, running a team breakdown, or escalating concerns. It protects team autonomy while keeping the initiative aligned.33installs35Running An Architectural AssessmentThis skill is a Research-phase playbook for an initiative shepherd producing an Architectural Assessment for an Architecture Council. It guides stakeholder interviews, current-state analysis of existing implementations, and documenting 2 to 4 candidate solution approaches with trade-offs before recommending a direction. It targets Bitwarden's Software Initiative Funnel and expects a 3-5 week, 40-80 hour effort.33installs36Running Work TransitionsThis skill is a six-phase playbook for moving ownership of code, frameworks, tooling, or operational responsibilities between teams. A team lead uses it whether receiving handed-over work or originating a handoff, to prepare materials, run transition sessions, work the support period, and run pulse checks and retrospectives. It defines a successful transition as the receiving team operating confidently and independently, not just a meeting held.32installs37Scoping And Handing Off To TeamsThis skill is the Scoping and Commitment phase playbook for an initiative shepherd, the final decision gate before major resource allocation. It guides producing a High-Level Architecture Plan, creating child epics, running per-team handoff meetings, and preparing a leadership go/no-go presentation. Its central rule is that each team owns its own work breakdown, not the shepherd.32installs38Shepherding An InitiativeThis skill is the end-to-end umbrella playbook for an initiative shepherd running an idea through Bitwarden's five-phase Software Initiative Funnel: Identification, Research, Proof of Concept, Scoping and Commitment, and Implementation. It maps each phase's effort, deliverables, and decision gate, and dispatches to the phase-specific deep-dive skills. Its throughline rule is that the shepherd owns the initiative while each team owns how it executes its part.32installs39Design ReviewThis skill grounds design critique in Bitwarden's design Code of Conduct and a 30/60/90 maturity framework. A developer or designer uses it when a Figma file or UI mockup is shared for feedback rather than implementation. It first identifies the design's stage, then gives stage-appropriate, product-focused feedback and evaluates user-visible copy alongside the visuals at 60% and 90%.26installs40Applying Bitwarden BrandingThis skill applies Bitwarden brand standards including logo usage, color palette, typography, iconography, and capitalization rules. It grounds decisions in bitwarden.com/brand and the bitwarden/brand repository, giving specific values like Bitwarden Blue #175DDC, the Inter typeface, and the 36px radius system. A developer or designer uses it when a task touches Bitwarden's visual brand surface and needs to check whether something is on-brand.25installs41Content Style GuideThis skill reviews and rewrites end-user-facing GUI copy against Bitwarden's product content style guide. A developer uses it when authoring or critiquing button labels, error messages, toasts, modals, onboarding, empty states, and form or helper text. It checks voice consistency, maps each string to its expected tone, and walks grammar and accessibility rules to return specific, actionable rewrites.25installs42Evolving Design System ComponentsThis skill drives Component Library work through Bitwarden's published governance process. A developer or designer uses it to propose a new UI pattern or modify an existing design-system component, aligning first with the design team, deciding Core vs Recipe/Snowflake with UI Foundation, and building it in the Figma library with the right property conventions. It walks the differing review gates for the create-new and modify-existing paths.25installs43Facilitating Design CritiqueThis skill grounds the facilitation of Bitwarden design critique in the team's etiquette guide and design review guidelines. A developer or designer uses it when the task is about the critique meeting itself rather than the substance of feedback, such as facilitating, presenting at, or prepping for a session. It separates the weekly team critique from a stakeholder product design review and covers roles, the session arc, and feedback do's and don'ts.25installs44Navigating Design Jira ProcessThis skill handles the Jira choreography around design work at Bitwarden: attaching final designs to engineering tickets, tracking the 30/60/90 critique cadence in Figma, and moving epics and stories through status transitions. A developer or designer uses it to set up Jira for a design project or move a ticket to Ready for Dev. It keeps design decisions visible alongside engineering work without a separate design tracker.25installs45Preparing Design HandoffThis skill is the end-of-In-Design gate for handing a design off to engineering. It checks two things together: the Figma file in Ready-for-Dev state (sections aligned to stories, tokens library-bound, strings annotated, edge states covered) and the matching Jira transitions. A designer uses it to confirm a design is actually ready before engineering picks it up. It surfaces common omissions and ends with an explicit go/no-go.25installs46Using FigmaThis skill reads and inspects Figma designs through Figma's Dev Mode MCP server without generating production code or mutating Figma. A developer or designer uses it to parse a Figma URL into fileKey and nodeId, then pull design context, variables and tokens, screenshots, or metadata for critique, copy review, or handoff prep. It maps each job to the smallest appropriate read tool and stays strictly read-only.25installs47Creating Pull RequestThis skill is a pull-request creation workflow for Bitwarden repositories. A developer uses it when creating PRs, writing PR descriptions, or preparing branches for review. It enforces a [PM-XXXXX] type-prefixed title format, fills the repo's PR template (or a fallback), pushes the branch, and creates a draft PR with gh while asking whether to add an AI review label.10installs