1password

Manage application secrets via the 1Password CLI with vault-backed references.

Updated May 4, 2026
One-click install
npx skills add https://github.com/JamesFincher/gengar --skill 1password-jamesfincher
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: 1password
Source: https://github.com/JamesFincher/gengar/tree/main/optional-skills/security/1password
Command: npx skills add https://github.com/JamesFincher/gengar --skill 1password-jamesfincher

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill prevents leaking credentials by replacing plaintext secrets and unmanaged files with secure retrieval and injection from 1Password.

Core Features & Use Cases

  • Service account token authentication: Use OP_SERVICE_ACCOUNT_TOKEN for non-interactive, reliable access across terminal calls.
  • Desktop app integration (interactive): Use op signin with tmux to keep authentication stable during Gengar terminal sessions.
  • Secret retrieval and injection: Read secrets from op://... references and inject them into templates or run commands with secret-backed environment variables (e.g., op read, op inject, op run).
  • Typical use case: Pull database credentials or one-time passwords from a vault reference and use them to run a deployment or maintenance command without ever manually copying sensitive values.

Quick Start

Ask Gengar to configure 1Password CLI access by setting OP_SERVICE_ACCOUNT_TOKEN and then retrieve a specific secret reference like op://app-prod/db/password to use it in op run.

Frequently Asked Questions about 1password

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I inject secrets from 1Password into environment variables for automation scripts?

You can inject secrets by using the 1Password CLI to read `op://` vault references and execute commands with `op run`, replacing plaintext credentials in your terminal automation securely.

What is the best way to manage application secrets without storing plaintext files?

Managing application secrets via 1Password CLI replaces plaintext files and environment variables with secure vault-backed references, pulling credentials dynamically during deployments without manual copying.

Does 1Password CLI work with non-interactive terminal automation for CI/CD pipelines?

Yes, 1Password CLI supports non-interactive terminal automation by using the `OP_SERVICE_ACCOUNT_TOKEN` environment variable for reliable, automated access without requiring an interactive signin flow.

How do I authenticate to a 1Password vault during an interactive desktop session?

You can authenticate to a 1Password vault during interactive desktop sessions by using `op signin` with tmux, which keeps the authentication stable throughout your terminal session.

What do I need to configure before pulling database credentials from a 1Password vault reference?

Before pulling database credentials, you need the 1Password CLI installed and either the `OP_SERVICE_ACCOUNT_TOKEN` set for non-interactive access or an interactive signin flow configured for desktop integration.

How does templating injection work with 1Password vault references?

Templating injection works by using the `op inject` command to populate template files with secret values retrieved directly from `op://...` vault references, ensuring sensitive data is populated dynamically without plaintext exposure.