1password

Retrieve and inject 1Password CLI secrets into commands and templates.

Updated Aug 23, 2026
One-click install
npx skills add https://github.com/big4council-prog/b4c-agent --skill 1password-big4council-prog
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: 1password
Source: https://github.com/big4council-prog/b4c-agent/tree/main/optional-skills/security/1password
Command: npx skills add https://github.com/big4council-prog/b4c-agent --skill 1password-big4council-prog

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill prevents insecure secret handling by guiding users to store and retrieve credentials in 1Password instead of exposing them in plaintext environment variables or files.

Core Features & Use Cases

  • 1Password CLI setup and authentication: Configure the 1Password CLI (op) using a service account token, desktop app integration, or a Connect server for automation-friendly sign-in.
  • Secret read and injection into workflows: Use op read to fetch secret values and op inject to replace template placeholders during configuration generation.
  • Safe command execution with secret env vars: Use op run to inject secrets at runtime for one-off commands without persisting sensitive data.

Use case example: Setting up a CI or local automation task that reads database credentials from op://Vault/Item/field, injects them into a config template, and runs a command using secret environment variables without printing secrets to logs.

Quick Start

Ask the skill to set up 1Password CLI usage using a service account token from OP_SERVICE_ACCOUNT_TOKEN for securely reading secrets with op.

Frequently Asked Questions about 1password

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I securely inject secrets into automation workflows using 1Password CLI?

You can inject secrets into automation workflows by using the 1Password CLI `op inject` command to replace template placeholders with secret values during configuration generation, preventing plaintext exposure.

What is the best way to run commands with secret environment variables non-interactively?

The best way to run commands with secret environment variables non-interactively is using `op run` for runtime injection alongside authentication via OP_SERVICE_ACCOUNT_TOKEN for headless execution without persisting sensitive data.

How do I configure 1Password CLI authentication for CI pipelines?

Configure 1Password CLI authentication for CI pipelines by setting up a service account token via the OP_SERVICE_ACCOUNT_TOKEN environment variable, enabling reliable headless terminal execution and secret reads.

Can I retrieve OTP codes from 1Password using the command line?

Yes, you can retrieve OTP codes using the 1Password CLI `op read` command to fetch specific secret fields like one-time passwords from your vault for downstream commands and automation tasks.

What are the guardrails for preventing raw secret exposure when using op CLI?

Guardrails for preventing raw secret exposure include using `op run` to inject secrets at runtime for one-off commands and avoiding printing secret values to logs during downstream command execution.

Does 1Password CLI work without the desktop app for headless terminal execution?

Yes, 1Password CLI works for headless terminal execution without the desktop app by authenticating via a service account token or a Connect server, enabling reliable non-interactive automation workflows.