1password

Integrate the 1Password CLI to retrieve and inject secrets into command-line operations.

Updated Jul 13, 2026
One-click install
npx skills add https://github.com/zeronx798/demo-hermes-agent --skill 1password-zeronx798
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: 1password
Source: https://github.com/zeronx798/demo-hermes-agent/tree/main/optional-skills/security/1password
Command: npx skills add https://github.com/zeronx798/demo-hermes-agent --skill 1password-zeronx798

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This skill eliminates the security risks of storing plaintext credentials in environment variables or configuration files by integrating the 1Password CLI directly into your agent's workflow.

Core Features & Use Cases

  • Secret Injection: Safely inject sensitive credentials into configuration templates or environment variables at runtime.
  • CLI Authentication: Manage 1Password sessions, including service account support for headless automation and desktop app integration for interactive tasks.
  • Use Case: Use this skill to automatically retrieve a database password from your 1Password vault and inject it into a connection string without ever exposing the secret in your terminal history or logs.

Quick Start

Use the 1password skill to read the secret value for the database password located in the app-prod vault.

Frequently Asked Questions about 1password

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I inject secrets into environment variables without exposing them in terminal history?

Secret injection retrieves credentials at runtime and populates environment variables or configuration templates directly. This prevents plaintext credentials from being saved in your terminal history or logs.

Can I use 1Password CLI to automate secret retrieval in headless environments?

Yes, headless automation is supported using service account tokens. This allows secure credential retrieval in automated workflows without requiring desktop app integration.

Do I need the op CLI binary to manage 1Password sessions for command-line operations?

Yes, the op CLI binary is required to perform secret retrieval and environment variable injection. You must also configure appropriate authentication, such as service account tokens or desktop app integration.

What is the best way to retrieve a database password from a vault for a connection string?

Retrieving a database password involves reading the secret value directly from your specified vault and injecting it into the connection string. This eliminates the security risks of storing plaintext credentials in configuration files.

Why does storing plaintext credentials in configuration files pose a security risk?

Storing plaintext credentials exposes sensitive data to anyone with file system access. Integrating the 1Password CLI directly into your workflow mitigates this risk by managing and injecting secrets securely at runtime.