1password

Inject secrets into commands using the 1Password CLI.

Updated Mar 25, 2026
One-click install
npx skills add https://github.com/afel6/scal-ai-pipeline --skill 1password-afel6
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: 1password
Source: https://github.com/afel6/scal-ai-pipeline/tree/main/hermes_skills_library/optional-skills/security/1password
Command: npx skills add https://github.com/afel6/scal-ai-pipeline --skill 1password-afel6

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill provides a reliable, auditable workflow for managing and injecting sensitive credentials via the 1Password CLI, removing the need for plaintext environment variables or secrets stored in files.

Core Features & Use Cases

  • Multiple authentication modes: supports service account tokens for headless automation, desktop app integration for interactive use, and Connect server for self-hosted setups.
  • Safe secret handling: read secrets, inject templates, and run commands with secret environment variables using op read, op inject, and op run to minimize exposure.
  • Execution resilience: guidance for using tmux to preserve desktop app authentication across non-interactive terminal calls and recommendations for CI-friendly service account flows.
  • Use Case: Automate CI pipelines to inject database credentials at runtime using a service account token to avoid storing secrets in repository or plain env files.

Quick Start

Sign in with a service account token and run op read to retrieve and inject a secret into your application configuration.

Frequently Asked Questions about 1password

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I inject secrets into CI/CD pipelines without using plaintext environment variables?

To inject secrets into CI/CD pipelines without plaintext environment variables, use the 1Password CLI with a service account token. This method reads secrets at runtime and injects them directly into your application configuration, preventing credential leakage in repositories or plain env files.

What is the best way to manage secrets for headless automation using 1Password?

The best way to manage secrets for headless automation is using 1Password CLI with service account tokens. This allows automated agents to securely read secrets and perform template injection without requiring interactive desktop app integration.

Can I use 1Password CLI with tmux to preserve authentication across non-interactive terminal calls?

Yes, you can use tmux to preserve 1Password CLI desktop app authentication across non-interactive terminal calls. This provides execution resilience by maintaining your interactive authentication session when commands are run from background processes.

Does the 1Password CLI support both interactive desktop app integration and headless service accounts?

Yes, 1Password CLI supports multiple authentication modes including service account tokens for headless automation, desktop app integration for interactive use, and Connect server for self-hosted setups.

How do I run commands with secret environment variables using the op CLI?

To run commands with secret environment variables, use the op run command. This allows you to execute applications with credentials injected securely at runtime, replacing the need to store sensitive data in plaintext environment files.