1password

Manage sensitive credentials and secrets via the 1Password CLI.

1|Updated May 12, 2026
One-click install
npx skills add https://github.com/projectedanx/hermes-agent --skill 1password-projectedanx
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: 1password
Source: https://github.com/projectedanx/hermes-agent/tree/main/optional-skills/security/1password
Command: npx skills add https://github.com/projectedanx/hermes-agent --skill 1password-projectedanx

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This skill eliminates the security risks of storing credentials in plaintext files or environment variables by integrating the 1Password CLI directly into your agentic workflows.

Core Features & Use Cases

  • Secret Management: Safely read, inject, and manage sensitive credentials like API keys and database passwords.
  • Workflow Automation: Use the op run and op inject commands to securely pass secrets to scripts and configuration templates at runtime.
  • Use Case: When a task requires an API key for a third-party service, use this skill to fetch the secret directly from your 1Password vault without ever exposing the value in your terminal history or logs.

Quick Start

Use the 1password skill to read the database password from the production vault and inject it into the application configuration file.

Frequently Asked Questions about 1password

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I securely retrieve secrets for automated CLI workflows without exposing them in terminal logs?

You can securely retrieve secrets for automated CLI workflows by interfacing directly with the 1Password CLI. This approach fetches credentials at runtime, preventing sensitive values from appearing in your terminal history or plaintext files.

Do I need the 1Password CLI installed to inject environment variables into configuration templates?

Yes, you need the 1Password CLI installed and a configured service account or desktop integration. These prerequisites enable secure access to your vault for injecting environment variables into configuration templates.

What is the best way to pass API keys to scripts at runtime using a password manager?

The best way to pass API keys to scripts at runtime is using the 1Password CLI's `op run` and `op inject` commands. This securely passes secrets directly from your vault to scripts without exposing the values in logs.

Can I automate system configuration by fetching database passwords directly from a vault?

Yes, you can automate system configuration by fetching database passwords directly from your 1Password vault. The skill facilitates secure authentication and secret retrieval to safely inject credentials into application configuration files.

How does secret management with a CLI eliminate plaintext credential storage risks?

Secret management with a CLI eliminates plaintext storage risks by integrating the 1Password CLI directly into agentic workflows. Credentials are retrieved securely from a vault at runtime instead of being stored in plaintext files or environment variables.

Are there limitations when using 1Password service accounts for automated environment variable injection?

The primary limitation is that automated environment variable injection requires a configured service account or desktop integration for secure access. Without proper 1Password CLI authentication, the automated secret retrieval process cannot execute.