Ok, just to make things clear, and to make sure I understand, an attack could look like this;

1. I trick you into using my GitEvil Repository Service (GERS™).

2. After you upload your data, I swap target site information (in this case name) with the name for GERS™.

3. Next time you log in to GERS™, you accidentally send the login information for target site instead.

4. Profit

In that case, keeping with the wish to keep the manager searchable without the master password, would it be possible to mitigate this by HMAC'ing the encrypted password with, for instance, the site name?

As should be obvious from the above, I'm no crypto expert.