feat: add bitwarden-designer and bitwarden-design-tools plugins

[withinfocus]

🎟️ Tracking

No Jira ticket — this work is from me working directly with the design team to package their published practices into Claude Code plugins. The two seed skills came from the designer-agent-skills branch on bitwarden/clients (one commit ahead of main, authored by Sukhleen). The rest is grounded in the Product and Design Confluence space and the canonical Bitwarden brand sources at bitwarden.com/brand and github.com/bitwarden/brand.

📔 Objective

Adds two new v0.1.0 plugins to the marketplace, split per design-team feedback into a persona half and a toolkit half:

bitwarden-designer (persona)

The Bitwarden product designer agent. Holds the design team's Code of Conduct and the 30/60/90 critique framework, and dispatches into the bitwarden-design-tools toolkit for everything else.

In-plugin skills (judgment-heavy, exercised in the room):

• design-review — Code of Conduct + 30/60/90 critique framework. Ported verbatim from the designer-agent-skills branch.
• facilitating-design-critique — running or participating in the weekly team critique or a one-off Product Design Review. Grounded in the Weekly Design Critique & Etiquette quick guide and the Product Design Review Guidelines.

bitwarden-design-tools (toolkit)

No agent — skills only, like bitwarden-delivery-tools. Composed by the bitwarden-designer persona and usable standalone.

• content-style-guide — Bitwarden's product content style guide for GUI copy (voice, tone, AP-style-with-exceptions grammar, sentence case in UI, no ampersands, accessibility-first language). Lean SKILL.md with detail split into references/grammar-mechanics.md and references/accessibility-rules.md.
• using-figma — read and inspect Figma designs via the Dev Mode MCP server. Per-job-to-be-done read-tool selection, with Code Connect and write tools documented in their own subsections.
• applying-bitwarden-branding — new skill. Bitwarden brand standards: logo usage, color palette (full HEX/HSL/SCSS reference), typography (Inter), iconography (the shield), capitalization rules ("B" is capitalized, "W" is never capitalized). Grounded in bitwarden.com/brand and github.com/bitwarden/brand. Includes references/color-palette.md (full palette with print CMYK) and references/brand-assets.md (asset inventory with repo-relative paths).
• preparing-design-handoff — Confluence handoff page, Figma Ready-for-Dev state, and Jira transitions. Full template field reference in references/handoff-template.md.
• evolving-design-system-components — propose new patterns or modify existing components per the published governance process. Figma branching, property ordering, documentation conventions in references/figma-conventions.md.
• navigating-design-jira-process — design tasks nested under engineering epics, the 30/60/90 iteration cadence, status transitions across the design and engineering boards, the one-off engineering story flow.

Why the split

Feedback on the original single-plugin PR was that judgment-heavy persona skills should live separately from reusable toolkit skills. The split mirrors the established pattern with bitwarden-shepherd + bitwarden-delivery-tools and bitwarden-tech-lead + bitwarden-delivery-tools. The persona is thin without the toolkit — both ship together — but the toolkit is usable standalone by designers, design-adjacent engineers, and PMs running a handoff.

Validation

• ./scripts/validate-plugin-structure.sh — ✅ both plugins
• ./scripts/validate-marketplace.sh — ✅
• npm run lint (prettier + cspell) — ✅
• New domain terms added to .cspell.json across the original and split work: askable, bwi, CMYK, ESL, EXIF, FigJam, Figma, inclusivity, Solutioning, unassigning, unassigns, ungroup, userflow, Userflows

[github-actions]

Plugin Validation Summary

PR #125 — bitwarden-design-tools & bitwarden-designer

Overall result: PASS. No critical or major errors block merge. A small set of minor/major recommendations are listed below for the authors' consideration.

---

1. Plugin Structure Validation (plugin-validator)

bitwarden-design-tools — PASS

• plugin.json complete: name, version (0.1.0, valid semver), description, author, homepage, repository, keywords.
• Version 0.1.0 matches .claude-plugin/marketplace.json (line 93) and CHANGELOG.md ([0.1.0] - 2026-05-22).
• 6 skills present, all with valid YAML frontmatter (name, description, when_to_use, allowed-tools).
• All references/ files declared in CHANGELOG.md exist on disk.
• CHANGELOG.md follows Keep a Changelog format; README.md present and comprehensive.
• No stray artifacts (.DS_Store, node_modules, .env*) and no hardcoded credentials.

No issues at any severity.

bitwarden-designer — PASS

• plugin.json complete; version 0.1.0 matches marketplace entry (line 87), CHANGELOG.md, and AGENT.md.
• Agent (agents/AGENT.md) frontmatter valid: name bitwarden-designer (lowercase-hyphen, 19 chars), four <example> blocks with <commentary>, model opus, color cyan, substantial system prompt.
• 2 skills present, both with valid frontmatter including when_to_use and properly scoped allowed-tools.
• README.md and CHANGELOG.md present and well-formed.
• No hardcoded credentials.

Minor (1):

• plugins/bitwarden-designer/.claude-plugin/plugin.json:18 — agents field points to a single file (./agents/AGENT.md). Auto-discovery convention is a directory (or omitting the field). Non-blocking; functions correctly. Remediation: optionally remove the agents line and rely on auto-discovery of ./agents/ for consistency with other plugins in the marketplace.

---

2. Skill Review (skill-reviewer)

bitwarden-design-tools skills

All six skills have valid frontmatter, healthy word counts (791–1,334), and progressive disclosure into references/. All referenced files exist.

Major (2):

• plugins/bitwarden-design-tools/skills/evolving-design-system-components/SKILL.md — body references Figma MCP tools search_design_system and get_libraries from the using-figma skill, but allowed-tools does not include those Figma tools. Remediation: either add the required Figma tools to allowed-tools, or state explicitly in the body that Figma access must dispatch into using-figma via the Skill tool.
• plugins/bitwarden-design-tools/skills/preparing-design-handoff/SKILL.md — same ambiguity: body references get_metadata, get_variable_defs, and search_design_system, but allowed-tools lists only Skill and Atlassian MCP tools. Remediation: same — either grant the Figma tools or make the dispatch-through-using-figma model explicit.

Minor (4):

• applying-bitwarden-branding/SKILL.md — trigger phrases live in when_to_use rather than description. Consider folding 1–2 trigger phrases into description to strengthen discovery matching.
• content-style-guide/SKILL.md — shortest skill (791 words); fine, but could clarify whether referenced sibling skills are bundled or external (it does this well for figma-to-angular but not for design-review).
• using-figma/SKILL.md — claims a read-centric center of gravity but allowed-tools includes write tools. Consider splitting write tools into a sibling skill to keep read-only blast radius minimal. Not blocking.
• Cross-cutting: align allowed-tools declarations across the two Figma-consuming skills above using a single explicit policy.

bitwarden-designer skills

Both skills pass; well-crafted with strong cross-skill disambiguation in when_to_use.

Minor (2):

• plugins/bitwarden-designer/skills/design-review/SKILL.md — word count ~970, just under the 1,000-word target floor. Lines 14–16 contain an awkwardly broken sentence ("Critique the product, not the / designer..."). Remediation: reflow the line break; optionally add an examples/ directory with a sample 30%/60%/90% critique.
• plugins/bitwarden-designer/skills/facilitating-design-critique/SKILL.md — no issues worth flagging.

---

3. Security Validation (reviewing-claude-config)

Result: PASS. No critical or major security issues.

• No settings.json or settings.local.json files in scope.
• No hardcoded credentials, API keys, tokens, passwords, or bearer tokens in any reviewed file.
• All matches for security-sensitive keywords are false positives: the word "tokens" refers to Figma design tokens, and "Password Manager"/"Secrets Manager" are Bitwarden product names.
• All SKILL.md files are appropriately sized (largest is 167 lines / ~1,334 words) — no oversized files.
• All YAML frontmatter parses cleanly.
• All referenced files in references/ directories exist on disk — no broken references.
• No allowed-tools declarations grant overly broad access; Atlassian MCP tool grants are namespaced and scoped to the specific operations each skill needs.

---

Summary

Severity	Count	Plugin/Skill	Must fix?
Critical	0	—	—
Major	2	evolving-design-system-components, preparing-design-handoff (allowed-tools ambiguity)	Should fix
Minor	7	See above	Optional

The PR is ready to merge. The two major findings are documentation/declaration ambiguities, not functional defects — recommend addressing them in this PR or a quick follow-up to keep allowed-tools honest about which Figma operations each skill performs directly versus by dispatching to using-figma.

[github-actions]

🤖 Bitwarden Claude Code Review

Overall Assessment: APPROVE

This is the fourth-pass review. Commit b2b26a8 adds when_to_use and allowed-tools frontmatter to all eight new skills across bitwarden-designer (2 skills) and bitwarden-design-tools (6 skills), restructures each description field to a single lean sentence with trigger phrases moved into when_to_use, and scopes allowed-tools per skill (Skill-only for self-contained skills; Confluence subset for facilitating-design-critique; full bitwarden-atlassian-tools surface for handoff/governance/Jira-workflow skills; full Figma Dev Mode MCP surface for using-figma). The pattern matches the established bitwarden-shepherd skill frontmatter convention verbatim, and the per-skill tool scoping aligns with each skill's actual content. No new findings.

Code Review Details

No new findings. The prior heading-drift thread remains resolved, and the fourth-pass frontmatter restructure is internally consistent with the canonical shepherd pattern. Version bumps are not required because both plugins are at their initial 0.1.0 release within this PR.