1password

Read, inject, and rotate secrets via the 1Password CLI.

14|2|Updated Mar 29, 2026
One-click install
npx skills add https://github.com/gquthier/CLAWG --skill 1password-gquthier
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: 1password
Source: https://github.com/gquthier/CLAWG/tree/main/optional-skills/security/1password
Command: npx skills add https://github.com/gquthier/CLAWG --skill 1password-gquthier

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This skill helps teams securely manage and access secrets without embedding them in plaintext, reducing exposure and credential leaks.

Core Features & Use Cases

  • Read secrets from 1Password vaults
  • Inject secrets into templates and runtime environments
  • Support for service accounts, desktop app integration, and Connect server to accommodate different auth flows

Quick Start

Sign in to 1Password and establish a trusted session to securely load secrets during CLAWG tasks.

Frequently Asked Questions about 1password

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I inject secrets from 1Password into automated scripts and templates?

You can inject secrets into templates by interfacing with the 1Password CLI to read sensitive data from vaults and load it directly into runtime environments. This prevents embedding credentials in plaintext during automation.

What authentication methods does the 1Password CLI support for secrets management?

The 1Password CLI supports authentication via service account tokens, desktop app integration, and Connect server. You must establish a trusted session using one of these methods before securely loading secrets.

How do I securely manage secrets in CI/CD pipelines without exposing plaintext credentials?

Secure secrets management in automated workflows is achieved by using the 1Password CLI to read and rotate sensitive data at runtime. This ensures credentials are injected into environments without being stored in plaintext.

Do I need the op CLI installed to read secrets from 1Password vaults?

Yes, an installed 1Password CLI (op) is required to read secrets from vaults. You also need one of the supported authentication methods, such as a service account token or desktop app integration, to establish a session.

Can I use 1Password Connect server for authentication in automated agent sessions?

Yes, 1Password Connect server is supported as an authentication method for automated workflows and agent sessions. It allows the CLI to securely interface with vaults to read and inject secrets without manual sign-in.

What are the limitations of using 1Password CLI for runtime secret rotation?

The primary limitation is the risk of leaking credentials if not properly guided during runtime secret usage. Users must ensure valid authentication sessions are maintained and avoid exposing sensitive data during injection and rotation processes.