1password

Configure the 1Password op CLI and read or inject secrets via op:// references.

Updated Sep 10, 2026
One-click install
npx skills add https://github.com/loteiron/ZeusAgent --skill 1password-loteiron
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: 1password
Source: https://github.com/loteiron/ZeusAgent/tree/main/optional-skills/security/1password
Command: npx skills add https://github.com/loteiron/ZeusAgent --skill 1password-loteiron

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Managing API keys, passwords, and tokens as plaintext environment variables or config files is risky and hard to rotate. This Skill sets up the 1Password CLI (op) so secrets stay in your vault and are only resolved at runtime. ## Core Features & Use Cases - CLI Setup & Authentication: Install op and sign in via desktop app integration, a service account token (OP_SERVICE_ACCOUNT_TOKEN), or a self-hosted Connect server. - Secret Operations: Read secrets with op read, fetch one-time passwords, inject secrets into templates with op inject, and run commands with secret env vars via op run. - Stable Sessions for Agents: Use a dedicated tmux session so desktop-app authentication persists across non-interactive terminal calls. - Use Case: You need a database password in a deployment script. Instead of hardcoding it, export DB_PASSWORD="op://app-prod/db/password" and run the script under op run so the value is resolved only at execution time. ## Quick Start Set up the 1Password CLI with my service account token and read the secret at op://Private/Npmjs/password without printing it.

Frequently Asked Questions about 1password

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I read a secret with the 1Password CLI?▼

Use op read with an op:// secret reference, for example op read "op://app-prod/db/password". You must be signed in via desktop app integration, a service account token, or a Connect server first.

How to inject secrets into config files with op inject?▼

Place op:// references inside a template, then pipe it through op inject, e.g. echo "db_password: {{ op://app-prod/db/password }}" | op inject. You can also use op inject -i config.tpl.yml -o config.yml for file-based templates.

Can I use 1Password CLI in CI or headless environments?▼

Yes, authenticate with OP_SERVICE_ACCOUNT_TOKEN instead of interactive op signin. Service accounts require CLI v2.18.0 or later and support op read, op inject, and op run without the desktop app.

Why does op say account is not signed in during agent terminal calls?▼

Non-interactive terminal calls can lose desktop-app auth context between commands. Run op signin and secret operations inside a dedicated tmux session, or switch to a service account token which persists automatically.

How do I run a command with secrets as environment variables?▼

Export the variable with an op:// reference, such as export DB_PASSWORD="op://app-prod/db/password", then execute the command under op run. The CLI resolves the reference at runtime so the plaintext value never touches your shell history or files.