op-exec

Resolve 1Password op:// references and inject secrets into shell command environments.

3|1|Updated Dec 3, 2025
One-click install
npx skills add https://github.com/nsheaps/ai-mktpl --skill op-exec
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: op-exec
Source: https://github.com/nsheaps/ai-mktpl/tree/main/plugins/1pass/skills/op-exec
Command: npx skills add https://github.com/nsheaps/ai-mktpl --skill op-exec

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

op-exec removes the manual and error-prone steps of resolving 1Password secrets when running shell commands by automatically injecting op:// secret references into the environment before executing processes.

Core Features & Use Cases

  • Resolves environment variables that contain op:// references and injects secrets into the wrapped command's environment.
  • Supports local development, container workflows, and CI/CD pipelines by using interactive sign-in or OP_SERVICE_ACCOUNT_TOKEN for service accounts.
  • Use cases include running deployment scripts that need database credentials, starting Docker Compose with secret environment variables, and automating CI steps that require secure keys.

Quick Start

Run ./deploy.sh while having DATABASE_URL set to an op:// reference so op-exec resolves it and executes the script.

Frequently Asked Questions about op-exec

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I inject 1Password secrets into shell commands?

To inject 1Password secrets into shell commands, op-exec automatically resolves op:// vault references in environment variables and passes them to the wrapped process. It executes commands with the necessary credentials securely populated.

Can I use 1Password service account tokens for CI/CD secret injection?

Yes, you can use 1Password service account tokens for CI/CD secret injection. op-exec supports the OP_SERVICE_ACCOUNT_TOKEN environment variable to resolve op:// references non-interactively in automated pipelines.

What is the best way to run Docker Compose with 1Password environment variables?

The best way to run Docker Compose with 1Password environment variables is wrapping the command with op-exec. It resolves op:// references in your environment before starting containers, ensuring secure secret delivery.

Does op-exec support interactive sign-in for local development?

Yes, op-exec supports interactive sign-in for local development. If a service account token is not provided, it resolves op:// secret references by prompting for standard 1Password CLI interactive authentication.

How do I automate deployment scripts that require secure database credentials?

You automate deployment scripts requiring secure database credentials by setting environment variables to op:// references and running them through op-exec. It resolves the 1Password entries and executes the script with injected secrets.

Why does my secret injection fail when resolving op:// references in containers?

Secret injection resolving op:// references in containers fails if authentication is missing. You must provide a valid OP_SERVICE_ACCOUNT_TOKEN or ensure interactive 1Password CLI sign-in is configured within the container environment.