1password

Retrieve and inject 1Password vault secrets into runtime environments.

Updated Jun 17, 2026
One-click install
npx skills add https://github.com/cxnaive/hermes-agent-llbot --skill 1password-cxnaive
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: 1password
Source: https://github.com/cxnaive/hermes-agent-llbot/tree/main/optional-skills/security/1password
Command: npx skills add https://github.com/cxnaive/hermes-agent-llbot --skill 1password-cxnaive

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This skill eliminates the security risks associated with storing sensitive credentials in plaintext environment variables or configuration files by leveraging the 1Password CLI for secure, on-demand secret retrieval.

Core Features & Use Cases

  • Secret Injection: Safely inject secrets into configuration templates or environment variables at runtime using the op inject and op run commands.
  • Credential Retrieval: Securely read passwords, API keys, or OTP tokens directly from your 1Password vault without exposing them in your shell history.
  • Use Case: When deploying a new service, use this skill to inject database credentials directly into your application environment without ever writing the password to a disk-based config file.

Quick Start

Use the 1password skill to read the database password from the app-prod vault and inject it into the current session.

Frequently Asked Questions about 1password

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I securely inject secrets into environment variables at runtime?

Secret injection at runtime uses the 1Password CLI to safely retrieve credentials and populate environment variables without writing plaintext passwords to disk-based config files. This prevents exposing sensitive data in your shell history.

How do I retrieve OTP tokens from my vault using the command line?

OTP retrieval is handled by integrating the 1Password CLI into your agent workflow, allowing you to securely read one-time passwords directly from your vault. This ensures authenticated command execution across various environments.

What's the best way to manage credentials for automated deployments without plaintext config files?

Managing credentials for deployments without plaintext files is achieved by leveraging the 1Password CLI for on-demand secret retrieval. You can inject database credentials directly into the application environment using op inject and op run commands.

Do I need a service account token to authenticate the 1Password CLI for secret management?

Yes, authenticating the 1Password CLI for secret management requires appropriate authentication via service account tokens or desktop integration. You must have the op CLI installed and configured to facilitate secure credential retrieval.

Can I read API keys from a vault without exposing them in my shell history?

Reading API keys without shell history exposure is possible by using the 1Password CLI to securely fetch secrets on demand. This method ensures sensitive credentials are injected directly into your session rather than typed manually.

Why should I avoid storing sensitive credentials in plaintext environment variables?

Storing credentials in plaintext environment variables poses security risks because they can be easily exposed. Using the 1Password CLI eliminates this risk by providing secure, on-demand secret retrieval directly from your encrypted vault.