What problem does it solve? Managing API keys, passwords, and tokens as plaintext environment variables or config files is risky and hard to rotate. This Skill sets up the 1Password CLI (op) so secrets stay in your vault and are only resolved at runtime. ## Core Features & Use Cases - CLI Setup & Authentication: Install op and sign in via desktop app integration, a service account token (OP_SERVICE_ACCOUNT_TOKEN), or a self-hosted Connect server. - Secret Operations: Read secrets with op read, fetch one-time passwords, inject secrets into templates with op inject, and run commands with secret env vars via op run. - Stable Sessions for Agents: Use a dedicated tmux session so desktop-app authentication persists across non-interactive terminal calls. - Use Case: You need a database password in a deployment script. Instead of hardcoding it, export DB_PASSWORD="op://app-prod/db/password" and run the script under op run so the value is resolved only at execution time. ## Quick Start Set up the 1Password CLI with my service account token and read the secret at op://Private/Npmjs/password without printing it.