1password

name	1password
description	Drives 1Password CLI (op) for service-account, desktop-app, or Connect auth, then op read, op inject, and op run so secrets stay out of plaintext env files. Use when installing op, signing in, resolving op:// references, injecting templates, or wrapping commands with secret env vars. Not for inventing vault items or password-reset UX; never print raw secrets unless the user explicitly asks.
version	1.0.1
license	MIT
platforms	["windows","linux","macos"]
metadata	{"hermes":{"tags":["security","secrets","1password","op","cli"],"category":"security"}}
setup	{"help":"Create a service account at https://my.1password.com → Settings → Service Accounts","collect_secrets":[{"env_var":"OP_SERVICE_ACCOUNT_TOKEN","prompt":"1Password Service Account Token","provider_url":"https://developer.1password.com/docs/service-accounts/","secret":true}]}

1Password CLI

Use this skill when the user wants secrets managed through 1Password instead of plaintext env vars or files. The primary host platform is Windows (PowerShell); Linux/macOS commands are provided where they differ.

When to Use

• Install or configure the 1Password CLI (op)
• Sign in with op signin (desktop app integration)
• Read secret references like op://Vault/Item/field
• Inject secrets into config/templates using op inject
• Run commands with secret env vars via op run
• Set up headless/CI authentication using a service account token

Prerequisites

• A 1Password account (personal, family, or business)
• 1Password CLI (op) installed — see Procedure below
• One of the following authentication methods:
  • Service Account token (OP_SERVICE_ACCOUNT_TOKEN) — recommended for automation/CI
  • Desktop App Integration — interactive, requires the 1Password desktop app unlocked
  • Connect Server — self-hosted, for shared/team automation
• tmux available for stable authenticated sessions during non-interactive terminal calls (desktop app flow only; not needed for service account token)

Procedure

1. Install the CLI

# Windows (winget) — primary
winget install AgileBits.1Password.CLI

# macOS
brew install 1password-cli

# Linux — see references/get-started.md for distro-specific package links
# Load references/get-started.md when the user needs Linux install details or distro-specific URLs.

2. Verify installation

op --version

3. Choose and configure an authentication method

Option A — Service Account (recommended for automation / Hermes)

Set OP_SERVICE_ACCOUNT_TOKEN in your environment. On Windows PowerShell:

$env:OP_SERVICE_ACCOUNT_TOKEN = "YOUR_TOKEN_HERE"

For persistent storage, add it to your shell profile or a .env file loaded by your agent framework. The skill will prompt for this token on first load if missing.