1password

Retrieve secrets from 1Password CLI without exposing them in output.

2|Updated Feb 10, 2026
One-click install
npx skills add https://github.com/dversoza/claude-skills --skill 1password-dversoza
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: 1password
Source: https://github.com/dversoza/claude-skills/tree/main/1password
Command: npx skills add https://github.com/dversoza/claude-skills --skill 1password-dversoza

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill provides secure patterns for accessing sensitive information like passwords, API keys, and tokens stored in 1Password, preventing them from being exposed in logs or conversation history.

Core Features & Use Cases

  • Secure Secret Retrieval: Safely fetch specific fields from 1Password items using their private links.
  • Leak Prevention: Enforces strict rules to avoid echoing secrets, storing them in environment variables, or including them in observable output.
  • Use Case: When a deployment script needs an API token, use this Skill to retrieve it securely from 1Password and pass it directly to the script's execution context without exposing the token itself.

Quick Start

Use the 1password skill to retrieve the 'api-key' field from the provided private link.

Frequently Asked Questions about 1password

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I securely retrieve secrets from 1Password CLI without exposing them in terminal output?

To securely retrieve secrets from 1Password CLI, you can pipe retrieved credentials directly into consuming commands or use wrapper scripts. This prevents sensitive data from leaking into terminal output or conversation context.

Can I use environment variables to store API keys fetched from 1Password?

You should not use environment variables to store API keys fetched from 1Password. This Skill enforces strict rules against storing credentials in environment variables to prevent observable output and potential leakage.

What is the best way to pass an API token from 1Password to a deployment script?

The best way to pass an API token to a deployment script is piping it directly from the 1Password CLI into the script's execution context. This ensures the token itself is never exposed in logs or conversation history.

Does this approach for secrets management prevent credentials from appearing in conversation history?

Yes, this approach for secrets management prevents credentials from appearing in conversation history. It provides secure access patterns that block sensitive data from leaking into observable outputs or logs.

How do I fetch a specific field from a 1Password item using a private link?

To fetch a specific field from a 1Password item, you use the 1Password CLI to securely retrieve the data from its provided private link. This method safely extracts specific fields like an API key without exposing the entire item.

What are the limitations of using wrapper scripts for secrets management with 1Password CLI?

A limitation of using wrapper scripts for secrets management is that they require strict adherence to security rules to avoid echoing secrets. You must ensure the script execution context does not inadvertently log the passed credentials.