| name | 1password |
| description | Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in, and reading/injecting secrets for commands. |
| version | 1.0.0 |
| author | arceus77-7, enhanced by Hermes Agent |
| license | MIT |
| platforms | ["linux","macos","windows"] |
| metadata | {"hermes":{"tags":["security","secrets","1password","op","cli"],"category":"security"}} |
| setup | {"help":"Create a service account at https://my.1password.com → Settings → Service Accounts","collect_secrets":[{"env_var":"OP_SERVICE_ACCOUNT_TOKEN","prompt":"1Password Service Account Token","provider_url":"https://developer.1password.com/docs/service-accounts/","secret":true}]} |
1Password CLI
Use this skill when the user wants secrets managed through 1Password instead of plaintext env vars or files.
Requirements
- 1Password account
- 1Password CLI (
op) installed
- One of: desktop app integration, service account token (
OP_SERVICE_ACCOUNT_TOKEN), or Connect server
tmux available for stable authenticated sessions during Hermes terminal calls (desktop app flow only)
When to Use
- Install or configure 1Password CLI
- Sign in with
op signin
- Read secret references like
op://Vault/Item/field
- Inject secrets into config/templates using
op inject
- Run commands with secret env vars via
op run
Authentication Methods
Service Account (recommended for Hermes)
Set OP_SERVICE_ACCOUNT_TOKEN in ${HERMES_HOME:-~/.hermes}/.env (the skill will prompt for this on first load).
No desktop app needed. Supports op read, op inject, op run.
export OP_SERVICE_ACCOUNT_TOKEN="your-token-here"
op whoami
Desktop App Integration (interactive)
- Enable in 1Password desktop app: Settings → Developer → Integrate with 1Password CLI
- Ensure app is unlocked
- Run
op signin and approve the biometric prompt
Connect Server (self-hosted)
export OP_CONNECT_HOST="http://localhost:8080"
export OP_CONNECT_TOKEN="your-connect-token"
Setup
- Install CLI:
brew install 1password-cli
winget install AgileBits.1Password.CLI
