The basic idea is that if your snapcraft.yaml you has something like:
apps:
foo:
command: bin/bar
plugs:
- password-manager-service
then create a shell script named ‘bin/bar.wrap’ (untested), adjust the snapcraft.yaml to use ‘bin/bar.wrap’ instead, and in it do:
#!/bin/sh
set -e
tell_user() {
...
}
alerted_user="$SNAP_USER_DATA/.advised-on-password-manager"
if [ ! -f "$alerted_user" ]; then
# XXX: https://forum.snapcraft.io/t/bug-1809708-allow-snaps-to-query-interface-connection-status-directly-from-snapd/9147
dbus-send --session --print-reply --dest=org.freedesktop.secrets /org/freedesktop/secrets org.freedesktop.DBus.Introspectable.Introspect >/dev/null 2>&1 || tell_user
touch "$alerted_user"
fi
exec /path/to/bin/bar "$@"
Then implement tell_user() using zenity or yad or something (you might find this and this useful). Hope this helps!