一键在 Manus 中运行任何 Skill

op-secrets

星标0

分支0

更新时间2026年7月18日 19:14

Moves a project's secrets out of plaintext and into 1Password secret references (op:// URIs) that resolve at runtime via the op CLI, producing a safe-to-commit .env template and an op run launch path so no real credential ever lands on disk. Use this skill when the user says "use 1Password for my env vars", "replace my .env secrets with op references", "set up op run for this project", "stop storing API keys in plaintext", or wants credentials injected from a 1Password vault at run time. Not for building an interactive service-setup script that captures values from a human (see the wizard skill), or for pushing secrets into GitHub Actions (see op-github-secrets).

安装

用 Codex 或 Claude 帮你安装复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。

在 Manus 中运行

来源

smithdak

smithdak/skillsmith

打开 GitHub 仓库查看创作者相关仓库

下载

在 Manus 中运行

op-secrets

A 1Password secret reference is a URI, op://<vault>/<item>/<field> (with an optional section: op://<vault>/<item>/<section>/<field>), that points at an encrypted secret rather than containing it. The reference is inert — only the op CLI, authenticated to the vault, can resolve it — so references are safe to commit to version control while the real values stay in 1Password and are fetched on demand. This skill converts a project to that model.

The credential boundary is the whole point: never print a resolved secret, never write a resolved value to a committed file, and never paste a real key into chat. Work in references and let op resolve them at the last moment. See references/op-cli.md for the exact commands, auth options, and masking behavior.

1 — Inventory the secrets

Read the project the way a fresh clone would: .env, .env.example, .env.*, framework config, docker-compose*, and any README setup section. List every secret-shaped value — API keys, tokens, connection strings, passwords — and, for each, the env var name it fills and whether it is truly secret or just config (URLs, ports, and public ids do not belong in a vault).

Done when: every env var is classified secret-or-config, and each secret has a target op://vault/item/field chosen (existing item, or one to create).

2 — Author the reference template

Produce a committable .env (or .env.template) where each secret line is an op:// reference and each config line is a plain value:

DATABASE_URL=op://Dev/myapp-db/url
STRIPE_SECRET_KEY=op://Dev/myapp-stripe/secret-key
PORT=3000

If items do not exist in the vault yet, list the op item create commands (or hand the human that step) — but do not fabricate field paths; a reference that points at a missing item fails at resolve time. Where a value must be captured interactively from a dashboard, that is the wizard skill's job — hand off.

3 — Wire runtime injection

Give the project a way to resolve references only in the process that needs them, with nothing persisted:

op run -- <command> runs the command with the referenced secrets present as environment variables for the process lifetime only, and masks them in output. This is the default for local dev and CI steps.
op inject templates a file of references into resolved values — use only when a tool cannot read env vars, and never write the output to a committed path.

Choose non-interactive auth (a scoped service account token) for automation, and the desktop app / biometric session for a developer's machine. Keep the service account scoped to the minimum vaults.

4 — Verify without leaking

op run --no-masking -- printenv is not how to check — that defers masking. Instead confirm resolution succeeds via exit status and that the app starts; never echo values to prove they resolved.
Confirm the committed template contains only op:// references and plain config — grep the diff for anything key-shaped before it is staged.
State which vault and which auth method the project now depends on, and what a new developer must run (op signin / provide a service-account token) to start it.

同仓库更多 Skills

同仓库

op-github-secrets

smithdak/skillsmith

Wires GitHub Actions to pull secrets from 1Password at run time instead of storing long-lived copies in GitHub — using the 1Password load-secrets action with op:// references and a scoped service-account token, so CI reads secrets on demand and 1Password masks them in logs. Use this skill when the user says "load secrets from 1Password in GitHub Actions", "stop pasting secrets into GitHub repo settings", "use a 1Password service account in CI", or wants a workflow that resolves op:// references during a job. Not for local runtime injection (see op-secrets) or an interactive human setup script (see the wizard skill).

2026-07-180

mermaid-to-tldraw

smithdak/skillsmith

Converts Mermaid diagram source into editable tldraw shapes using tldraw's official @tldraw/mermaid package, so a flowchart or graph written as Mermaid text becomes real, movable nodes and arrows on a tldraw canvas rather than a static image. Use this skill when the user says "convert this mermaid to tldraw", "turn my mermaid flowchart into editable tldraw shapes", "import mermaid into tldraw", or has Mermaid source they want as a hand-editable canvas. Not for authoring Mermaid text itself, rendering Mermaid to an image, or building a tldraw file from a prose description (see tldraw-diagram).

2026-07-180

tldraw-animation

smithdak/skillsmith

Adds motion to a tldraw canvas — animating shape position, rotation, and props over time with easing, animating the camera through a canvas, and authoring durable requestAnimationFrame loops embedded in a tldraw-offline document so the canvas keeps animating whenever it is opened. Use this skill when the user says "animate this tldraw diagram", "make these shapes move", "add an animation to my tldraw canvas", "create a tldraw animation loop", or "animate the camera through my board". Not for generating a static .tldr (see tldraw-diagram), exporting a canvas to an image (see tldraw-export), or CSS / web / video-file animation outside tldraw.

2026-07-180

tldraw-diagram

smithdak/skillsmith

Generates a tldraw canvas file (.tldr / .tldraw JSON) from a described diagram or outline — boxes, arrows, text, frames, and notes positioned on the infinite canvas — so it opens directly in tldraw or tldraw-offline as editable shapes, with no browser or render step. Use this skill when the user says "make me a tldraw diagram", "generate a .tldr file", "turn this architecture into a tldraw whiteboard", "build an editable canvas of this flow", or wants a hand-editable tldraw document rather than a flat image. Not for rendering a canvas to PNG/SVG (that needs a browser — see tldraw-export), converting Mermaid source (see mermaid-to-tldraw), or authoring Mermaid/Graphviz text diagrams.

2026-07-180

tldraw-export

smithdak/skillsmith

Renders a tldraw canvas or .tldr file to a static image — SVG, PNG, JPEG, or WebP — by driving tldraw's browser-based export APIs from a headless browser, producing a shareable picture from an editable canvas. Use this skill when the user says "export my tldraw file to PNG", "render this .tldr as an SVG", "turn my tldraw canvas into an image", or needs a flat image out of a tldraw document. Not for generating an editable .tldr from a description (see tldraw-diagram), converting Mermaid (see mermaid-to-tldraw), or exporting from the tldraw desktop app's own File menu.

name	op-secrets
description	Moves a project's secrets out of plaintext and into 1Password secret references (op:// URIs) that resolve at runtime via the op CLI, producing a safe-to-commit .env template and an op run launch path so no real credential ever lands on disk. Use this skill when the user says "use 1Password for my env vars", "replace my .env secrets with op references", "set up op run for this project", "stop storing API keys in plaintext", or wants credentials injected from a 1Password vault at run time. Not for building an interactive service-setup script that captures values from a human (see the wizard skill), or for pushing secrets into GitHub Actions (see op-github-secrets).
license	MIT
metadata	{"skillsmith-see-also":"wizard, op-github-secrets","skillsmith-invocation":"user","skillsmith-maturity":"experimental"}
user-invocable	true

op-secrets

1 — Inventory the secrets

Done when: every env var is classified secret-or-config, and each secret has a target op://vault/item/field chosen (existing item, or one to create).

2 — Author the reference template

Produce a committable .env (or .env.template) where each secret line is an op:// reference and each config line is a plain value:

DATABASE_URL=op://Dev/myapp-db/url
STRIPE_SECRET_KEY=op://Dev/myapp-stripe/secret-key
PORT=3000

3 — Wire runtime injection

Give the project a way to resolve references only in the process that needs them, with nothing persisted:

op run -- <command> runs the command with the referenced secrets present as environment variables for the process lifetime only, and masks them in output. This is the default for local dev and CI steps.
op inject templates a file of references into resolved values — use only when a tool cannot read env vars, and never write the output to a committed path.

4 — Verify without leaking

op run --no-masking -- printenv is not how to check — that defers masking. Instead confirm resolution succeeds via exit status and that the app starts; never echo values to prove they resolved.
Confirm the committed template contains only op:// references and plain config — grep the diff for anything key-shaped before it is staged.
State which vault and which auth method the project now depends on, and what a new developer must run (op signin / provide a service-account token) to start it.