1password

Retrieve and inject 1Password vault secrets into command-line environments.

Updated May 4, 2026
One-click install
npx skills add https://github.com/InverterNetwork/hermes-agent --skill 1password-inverternetwork
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: 1password
Source: https://github.com/InverterNetwork/hermes-agent/tree/main/optional-skills/security/1password
Command: npx skills add https://github.com/InverterNetwork/hermes-agent --skill 1password-inverternetwork

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This skill eliminates the security risks associated with storing sensitive credentials in plaintext environment variables or configuration files by leveraging 1Password's robust CLI.

Core Features & Use Cases

  • Secret Injection: Safely inject secrets into templates or command-line arguments at runtime using op inject.
  • Credential Retrieval: Fetch passwords, API keys, or OTP codes directly from your 1Password vault.
  • Use Case: When running a deployment script that requires a database password, use this skill to inject the secret directly into the process environment without ever writing it to disk.

Quick Start

Use the 1password skill to read the database password from the vault path op://app-prod/db/password and inject it into your current session.

Frequently Asked Questions about 1password

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I inject secrets into environment variables for a deployment script?

To inject secrets into environment variables, this skill uses the 1Password CLI `op inject` command to securely retrieve credentials from your vault and inject them directly into the process environment at runtime without writing to disk.

How can I retrieve API keys and OTP codes from my vault in an automated workflow?

You can retrieve API keys and OTP codes by integrating the 1Password CLI into your agent's execution environment, fetching credentials directly from specified vault paths like `op://app-prod/db/password` for authenticated command execution.

Do I need a service account token to use the 1Password CLI for secret management?

You need either a service account token or desktop app integration to authenticate with the 1Password CLI, which is required by this skill to facilitate secure secret retrieval and template injection.

What is the best way to manage sensitive credentials without storing them in plaintext configuration files?

The best way to manage sensitive credentials without plaintext files is leveraging 1Password's CLI to securely retrieve secrets at runtime, eliminating the security risks associated with storing passwords in plaintext environment variables.

Can I use this 1Password CLI integration for production workflows requiring authenticated commands?

Yes, this skill facilitates authenticated command execution for production workflows by safely injecting secrets into templates or command-line arguments at runtime using the 1Password CLI.

Why should I not store database passwords in plaintext environment variables?

Storing database passwords in plaintext environment variables creates security risks; this skill mitigates those risks by using the 1Password CLI to inject secrets directly into your session at runtime.