- Facilitating Design CritiqueRun or participate in a Bitwarden design critique session — the weekly team critique and one-off product design reviews — grounded in the team's published etiquette guide and the Product Design Review Guidelines.bitwarden/ai-plugins154
- Filing Breakdown TasksTurn a tech breakdown's tasks.md into Jira ticket drafts — an epic parent plus one child story/task per task entry, each a real ticket with acceptance criteria and mapped Blocked-by/Depends-on links — then hand off to filing-jira-tickets to file them.bitwarden/ai-plugins154
- Filing Jira TicketsFile Jira work items that stand on their own, with real ticket titles, acceptance criteria in whatever field the target project provides, and verified dependency links. Reads the target project's create screen first, so no project's field layout is assumed.bitwarden/ai-plugins154
- Force MultiplierApply one intent across many targets at once — a fleet of repositories across the Bitwarden ecosystem, or many projects inside a monorepo — as N consistent, idempotent, reviewable draft PRs.bitwarden/ai-plugins154
- Labeling ChangesConventional commit type keywords for PR titles and commit messages. Use when determining the change type for commits or PRs, or when another delivery skill asks for the type keyword and its t: label. Triggered by "what type", "label", "change type", "conventional commit", "t: label".bitwarden/ai-plugins154
- Managing Feature FlagsBitwarden's feature-flag conventions and lifecycle — how server and clients evaluate flags, how to name and scope them, and how a release flag progresses from creation to cleanup. Use when deciding whether work needs a flag, gating a new code path, naming a flag, planning a rollout, or removing a launched one. Triggered by "feature flag", "flag this", "put it behind a flag", "LaunchDarkly", "IFeatureService", "FeatureFlagKeys", "RequireFeature", "gradual rollout", "flag cleanup", "kill switch".bitwarden/ai-plugins154
- Managing Workflow SecretsBitwarden's canonical pattern for using a secret inside a GitHub Actions job: authenticate to Azure with the OIDC triad, pull the secret from an Azure Key Vault via the bitwarden/gh-actions composite actions (azure-login → get-keyvault-secrets → azure-logout), consume it safely, and get it beyond the job or into a reusable workflow when needed. Use when questions like "add a step to pull the DockerHub token from Key Vault before we push the image", "do I need id-token: write on this job that logbitwarden/ai-plugins154
- Navigating Design Jira ProcessMove design work through Bitwarden's Product and Design Jira workflow — final designs attached to tickets, the 30/60/90 critique cadence tracked in Figma, status transitions on engineering epics and stories, and the one-off engineering story flow.bitwarden/ai-plugins154
- Navigating The Initiative FunnelPhase-by-phase guidance for participating in Bitwarden's Software Initiative Funnel. Covers shepherd vs tech-lead ownership, running an epic breakdown after Scoping & Commitment handoff, sizing, cross-team dependency tracking, and escalation paths that protect team autonomy. Use when receiving an initiative epic, participating in an Architectural Assessment or PoC, preparing the Scoping & Commitment breakdown, or surfacing concerns to the shepherd or engineering leadership.bitwarden/ai-plugins154
- Perform PreflightQuality gate checklist to run before committing or creating a PR. Use when finishing implementation, checking work quality, or preparing to commit. Triggered by "preflight", "self review", "ready to commit", "check my work", "quality gate".bitwarden/ai-plugins154
- Perform Security ReviewPerforms a security-focused code review by launching multiple specialized agents and a verification agent to ensure comprehensive coverage and accurate findings. Use this skill when the user asks for a "perform-security-review", "bitwarden-security-review", "execute a security review", "run a comprehensive security audit", "perform an end-to-end security assessment", or needs to coordinate multiple security checks across code, dependencies, secrets, and configurations. The skill manages the workbitwarden/ai-plugins154
- Performing Multi Agent Code ReviewPerform a rigorous, multi-agent code review with architecture-compliance, parallel quality/security analysis, finding validation, and severity audit. Use when the user asks for a structured, deep, thorough, multi-pass, or multi-agent code review — or a review that includes architecture/pattern compliance, confidence-scored findings, or a severity audit. Use when the user asks for a code review across a commit range, time window, or N most recent commits in a locally checked-out repo.bitwarden/ai-plugins154
- Posting Bitwarden Review CommentsUse this skill when emitting inline review comments, whether posted to a GitHub pull request or written to a local file under caller-declared local-file output. Apply when formatting comments following Bitwarden engineering standards with severity emojis, clear explanations, and actionable suggestions. Use after findings are classified and ready to emit. DO NOT USE when posting summary comments.bitwarden/ai-plugins154
- Posting Review SummaryUse this skill when posting the final summary comment, including its No Verdict form when nothing could be reviewed and no inline comments exist. Otherwise apply as the LAST step of code review, after all findings are classified and inline comments are complete. Detects context (caller-declared local-file output, agent mode sticky comment, GitHub Actions MCP tool, or local file) and routes output accordingly.bitwarden/ai-plugins154
- Preparing Design HandoffPrepare a Bitwarden design handoff — the Figma file in Ready-for-Dev state and the Jira state transitions that go with it. The end-of-In-Design gate / checklist.bitwarden/ai-plugins154
- Recommending Test LayersUse when deciding WHICH new tests a change needs and at WHICH layer each belongs, working from a Jira key, a Testmo CSV, an assessing-test-coverage report, a PR, or a feature description. Triggers on "should I add integration tests here", "are unit tests enough", "what tests should I add and where", "what layer should this test go at", "which of these cases should be automated and at what layer", "what's the right test strategy for this feature", "pyramid or trophy for this change". This is a fobitwarden/ai-plugins154
- Researching Jira IssuesUse whenever the user mentions a Jira issue key and wants more than a surface-level lookup — "Read PROJ-123", "What's PROJ-123 about?", "Give me context on PROJ-123", "Deep dive PROJ-123", "What's blocking PROJ-123?", "Summarize PROJ-123 and its dependencies", "I need to work on PROJ-123, what should I know?", or any request to understand an issue's purpose, scope, or requirements. Thoroughly researches and synthesizes a Jira issue including all linked issues, sub-tasks, blocked dependencies, anbitwarden/ai-plugins154
- RetrospectingPerforms comprehensive analysis of Claude Code sessions, examining git history, conversation logs, code changes, and gathering user feedback to generate actionable retrospective reports with insights for continuous improvement.bitwarden/ai-plugins154
- Reviewing Agent DefinitionsReviews Claude Code agent definition files for tool-access security, triggering quality, and system prompt clarity. Use when reviewing changes to agents/<name>.md or agents/<name>/AGENT.md, whether under .claude/agents/ or inside a plugin. Flags over-privileged tool grants, unjustified Bash access, descriptions with no activation triggers, and system prompts too vague to act on. Also use when asked to audit a subagent's tool access or check whether an agent will trigger. Normally reached throughbitwarden/ai-plugins154
- Reviewing Claude ConfigReviews Claude configuration files for security, structure, and prompt engineering quality. Use when reviewing changes to CLAUDE.md, agents, prompts, commands, hooks, or settings. Routes each file type to a targeted review skill and returns classified findings. Flags settings.local.json appearing in a changeset, hardcoded secrets, malformed YAML, insecure agent tool access, and unsafe hook commands. Does not review SKILL.md files — plugin-dev:skill-reviewer owns those.bitwarden/ai-plugins154
- Reviewing Command DefinitionsReviews Claude Code slash command and prompt files for purpose clarity, completeness, shell-execution safety, and correct skill references. Use when reviewing changes to commands/**/*.md at any location, or .claude/prompts/**/*.md. Flags argument interpolation into a shell string, commands with no stated purpose or usage, complex tasks left as one vague instruction, and references to skills that do not exist. Also use when asked to check a slash command or review what a command actually runs. Nobitwarden/ai-plugins154
- Reviewing DependenciesThis skill should be used when the user asks to "review Dependabot alerts", "check for vulnerable dependencies", "audit third-party packages", "assess supply chain risk", "run an Aikido scan", or needs to evaluate dependency health, transitive risk, or supply chain security.bitwarden/ai-plugins154
- Reviewing Dependency ChangesUse this skill when a PR diff contains changes to dependency manifest files (package.json, .csproj, Cargo.toml, go.mod, requirements.txt, etc.) or when reviewing Renovate/Dependabot bot PRs. Evaluates new dependencies for AppSec approval process compliance, major version bump significance, lock file hygiene, and dependency removal completeness. Does NOT perform deep security or license analysis — that is handled by the bitwarden-security-engineer plugin's reviewing-dependencies skill.bitwarden/ai-plugins154
- Reviewing Project GuidanceReviews CLAUDE.md files for security, structure, and directive clarity. Use when reviewing changes to CLAUDE.md at a project root, in .claude/, or scoped to a subdirectory. Flags credentials and sensitive paths in guidance text, detailed specifications that belong in their own docs, directives too vague to act on, and directives that loosen the harness itself such as `--dangerously-skip-permissions` or `--no-verify`. Also use when asked to review project instructions or CLAUDE.md quality. Normalbitwarden/ai-plugins154
- Reviewing Runtime ConfigurationReviews Claude Code settings and hook definitions for security, permission scoping, and command safety. Use when reviewing changes to .claude/settings.json, .claude/settings.local.json, or hooks.json in a repository or plugin. Flags local settings appearing in a changeset, hardcoded secrets, filesystem-wide permissions, dangerous auto-approvals, and hook commands that exfiltrate data or route their input into a shell. Also use when asked to review hooks, audit permissions, or check what runs witbitwarden/ai-plugins154
- Reviewing Security ArchitectureThis skill should be used when the user asks to "review the security architecture", "check authentication patterns", "evaluate trust boundaries", "review encryption implementation", "assess authorization design", or needs to evaluate system designs for authentication, authorization, data protection, or cryptographic correctness.bitwarden/ai-plugins154
- Running A Proof Of ConceptPhase 3 (Proof of Concept) deep-dive playbook — validates the Research recommendation in real Bitwarden code and drafts the ADR.bitwarden/ai-plugins154
- Running An Architectural AssessmentPhase 2 (Research) deep-dive playbook — drafts the Architectural Assessment.bitwarden/ai-plugins154
- Running Work TransitionsSix-phase playbook for running ownership transitions in either direction — receiving work from another team (initiative handoffs from shepherds, frameworks from Platform, operational responsibilities from SRE), or originating a transition (handing off a built framework, transitioning a shepherded initiative, or moving operational responsibilities). Applies Bitwarden's Work Transition Playbook from whichever side a team is on. Use when a team is about to take on or hand off transferred work, whenbitwarden/ai-plugins154
- Scoping And Handing Off To TeamsPhase 4 (Scoping & Commitment) deep-dive playbook — High-Level Architecture Plan, child epics, per-team handoffs, leadership go/no-go.bitwarden/ai-plugins154
- Shepherding An InitiativeFive-phase umbrella playbook for an initiative shepherd. Dispatches to phase-deep skills (Research, PoC, Scoping, Implementation) at the right moment.bitwarden/ai-plugins154
- Threat ModelingThis skill should be used when the user asks to "create a threat model", "define security goals", "generate a data flow diagram", "write security definitions", "perform an initial security assessment", or needs to produce threat model artifacts for new features or architecture changes.bitwarden/ai-plugins154
- Triaging Security FindingsThis skill should be used when the user asks to "triage security findings", "fix an Aikido finding", "review Aikido issues", "dismiss a false positive", "check SAST/IaC alerts", or needs to work with Aikido feed issues, GitHub Dependabot alerts, or GitHub secret scanning alerts.bitwarden/ai-plugins154
- Using FigmaRead and inspect Figma designs via the Dev Mode MCP server — selects the right tool, parses Figma URLs into fileKey and nodeId, and turns design context into useful input for critique, copy review, handoff prep, and Design System work.bitwarden/ai-plugins154
- Workflow AuditRun the Bitwarden workflow linter (bwwl) against one or more repos and report findings. Strictly read-only — does not modify any files. Categorizes findings as mechanical or judgment using the bitwarden-workflow-linter-rules skill. Supports single repo, multiple repos, or single file/directory scope. <example> User: Run the workflow linter on the server repo Action: Trigger workflow-audit for that repo </example> <example> User: Lint the workflows across server, clients, and android Action: Trigbitwarden/ai-plugins154
- Workflow FixApply fixes for workflow linter findings identified by the workflow-audit skill. Applies mechanical fixes automatically, pauses for judgment calls, verifies with a re-lint, and creates draft PRs. Run the workflow-audit skill first to identify findings before using this skill. <example> User: Go ahead and fix the linter findings from the audit Action: Trigger workflow-fix to apply fixes and create PRs </example> <example> User: Fix the workflow linter issues in server and clients Action: Trigger bitwarden/ai-plugins154
- Writing Manual Test CasesUse when authoring NEW manual test cases in Gherkin format from a feature description, Jira ticket, acceptance criteria, PR, or design doc — the kind a QA engineer imports into Testmo. Triggers on "write test cases for", "manual test cases", "Gherkin scenarios for this ticket", "test cases for Testmo", "what scenarios should we test for this feature". Produces a paired .txt and Testmo-importable .csv. Do NOT use it to write automated test code (NUnit, Jest, xUnit, Playwright), to inventory what bitwarden/ai-plugins154
- Writing Release NotesWrite user-facing release notes for a Bitwarden release from a Jira release tag and thebitwarden/ai-plugins154
- Agent AccessRetrieve login credentials, API keys, and secrets (username, password, TOTP) from the user's Bitwarden vault via aac. Use when you need credentials to sign into a website or service, or need an API key.bitwarden/agent-access138
- Create TestvectorsRecord a serialized/encrypted format as a permanent test vector. Use when adding a type whose serialization format must stay backward-compatible (envelopes, COSE blobs, encrypted/wire formats), or when the user asks to "create a test vector", "record a serialized format", or "lock in the wire format". Generates output with a temporary ignored test, then pins it in a permanent deserialization unit test.bitwarden/sdk-internal111