菜单
Use when op run fails with env conflicts, direnv isn't loading secrets, source_up chain is broken, Claude shell can't resolve op:// URIs, or secrets work in terminal but not in Claude context
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Deep codebase analysis — architecture health, test coverage gaps, tech debt, and actionable findings
Run pre-commit checks (fmt, clippy, test) then stage, commit, and push with a conventional message
Review staged or recent changes for correctness, style, and Rust conventions before committing
Use when SSHing into remote machines, looking up credentials, renaming Tailscale devices, or accessing services on the tailnet. Symptoms - SSH auth failures, too many authentication failures, command not found tailscale, need to find credentials for remote machines.
Use when mixing Tokio async code with synchronous blocking I/O libraries (tar, flate2, zip, csv), or when seeing "cannot block the current thread from within the async context" panics, or needing to stream async bytes into a sync reader.
Structured BAML schema edit → validate → test loop for the devloop project. Use when editing any *.baml file in crates/baml/baml_src/ — covers version parity gotchas, uvx invocation, regeneration workflow, and the analyze verify step.
| name | env-debug |
| description | Use when op run fails with env conflicts, direnv isn't loading secrets, source_up chain is broken, Claude shell can't resolve op:// URIs, or secrets work in terminal but not in Claude context |
Systematic diagnosis of the secrets environment chain: direnv → source_up → 1Password → op run.
~/.envrc (or project .envrc)
└── source_up
└── ~/dev/.envrc
└── op run --env-file ~/.secrets -- <cmd>
└── injects resolved op:// vars
Claude's shell context cannot resolve op:// URIs directly. Always use op read or op run explicitly.
direnv status # Allowed? Which .envrc loaded?
direnv allow # Unblock current directory if needed
echo $DIRENV_DIR # Should be set if active
cat ~/.envrc
cat ~/dev/.envrc # Walk up until you find the op run call
op run inherits the shell environment first. If a var is already set, it will not be overridden.
# See conflicting vars
env | grep -E "KEY|TOKEN|SECRET" | sort
# Clear specific conflicts before op run
env -u OPENAI_API_KEY -u ANTHROPIC_API_KEY op run --env-file ~/.secrets -- your-command
# Nuke all and re-inject
unset OPENAI_API_KEY ANTHROPIC_API_KEY
op run --account=my.1password.com --env-file ~/.secrets -- your-command
op account list # Signed-in accounts
op signin --account my.1password.com # Sign in if needed
op item list --account=my.1password.com --limit=3 # Test read access
op read "op://vault/item/field" --account=my.1password.com
# Example:
op read "op://Personal/OPENAI/credential" --account=my.1password.com
echo "=== direnv ===" && direnv status
echo "=== op accounts ===" && op account list
echo "=== conflicting vars ===" && env | grep -E "KEY|TOKEN|SECRET" | sort
echo "=== op read test ===" && op item list --account=my.1password.com --limit=1
| Symptom | Cause | Fix |
|---|---|---|
op:// not resolved in Claude | Shell can't use direnv | Use op read directly |
op run ignores a secret | Var already in shell | env -u VAR op run ... |
| Secret works in terminal, not Claude | direnv not in Claude's shell | op read or op run explicitly |
op: not signed in | Session expired | op signin --account my.1password.com |
direnv: .envrc not allowed | direnv blocked | direnv allow |
source_up: no parent .envrc | Chain broken | Check ~/dev/.envrc exists |
grep ^KEY ~/.secrets returns empty | Key name mismatch | grep KEY ~/.secrets to find exact name |