How do I install the Op Secret Template skill?

Run npx skillmds@latest add aibot88/op-secret-template in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Op Secret Template safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: CAUTION, Skill Scanner: PASS. Capability flags: makes network calls, reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Op Secret Template?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Op Secret Template free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Op Secret Template?

aibot88 (@aibot88) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Op Secret Template by aibot88 — Agent Skill

Name: Op Secret Template
Rating: 4.2 (5 reviews)
Author: aibot88

File contents

/op-secret-template

Given an item identifier, print every field on the item as a KEY=op://... line, suitable for a .env template used with op run --env-file=.env -- ....

Inputs

$ARGUMENTS — first arg is the item name or ID. Optionally --vault <vault> to scope the lookup.

Steps

Fetch the item as JSON:
```
op item get $ARGUMENTS --format=json
```
From the JSON, extract:
- vault.name (call this VAULT)
- title (call this ITEM)
- For each entry in fields[]:
  - label (or id if no label)
  - section.label if section is present
  - purpose (PASSWORD, USERNAME, NOTES, etc.) if no label
  - type (STRING, CONCEALED, URL, EMAIL, OTP, DATE, MONTH_YEAR, PHONE)
Emit KEY=op://VAULT/ITEM[/SECTION]/FIELD_LABEL lines:
- Skip fields with no value AND no label (CLI metadata).
- Use the human-readable label for the secret reference.
- Convert each label to a SCREAMING_SNAKE env var name on the left side.
- For OTP fields, append ?attribute=otp so it returns the current code.
- For SSH private-key fields, append ?ssh-format=openssh.

Wrap output in a fenced block with a header explaining usage:

# Generated for item "ITEM" in vault "VAULT"
# Use with: op run --env-file=.env -- <command>
USERNAME=op://VAULT/ITEM/username
PASSWORD=op://VAULT/ITEM/password
API_KEY=op://VAULT/ITEM/Credentials/api_key
TOTP=op://VAULT/ITEM/totp?attribute=otp

Note any field type that needs special handling (file attachments → op read --out-file ... not env, document attachments not supported).

Edge cases

Multiple sections with same field name → include the section name in the reference so the URI is unambiguous.
Whitespace in vault/item/field names → wrap the whole reference value in single quotes in the output: KEY='op://Acme Prod/My Item/api key'.
Special characters that secret refs don't allow → use the field's id instead of label, and note "(using ID instead of name due to special characters)".
Item is a Document or has file attachments → emit a comment line explaining op read --out-file is needed instead of env loading.

On failure

Item not found → suggest /op-find <query> to locate it.
Multiple matches (interactive only error) → tell the user to disambiguate by ID or --vault.

---name: op-secret-templatedescription: Generate `op://` secret references for every field on a 1Password item. Output is ready to paste into a `.env` template.--- # /op-secret-template Given an item identifier, print every field on the item as a `KEY=op://...` line, suitable for a `.env` template used with `op run --env-file=.env -- ...`. ## Inputs `$ARGUMENTS` — first arg is the item name or ID. Optionally `--vault <vault>` to scope the lookup. ## Steps 1. Fetch the item as JSON: ```bash op item get $ARGUMENTS --format=json ``` 2. From the JSON, extract: - `vault.name` (call this `VAULT`) - `title` (call this `ITEM`) - For each entry in `fields[]`: - `label` (or `id` if no label) - `section.label` if `section` is present - `purpose` (`PASSWORD`, `USERNAME`, `NOTES`, etc.) if no label - `type` (`STRING`, `CONCEALED`, `URL`, `EMAIL`, `OTP`, `DATE`, `MONTH_YEAR`, `PHONE`) 3. Emit `KEY=op://VAULT/ITEM[/SECTION]/FIELD_LABEL` lines: - Skip fields with no value AND no label (CLI metadata). - Use the human-readable label for the secret reference. - Convert each label to a SCREAMING_SNAKE env var name on the left side. - For OTP fields, append `?attribute=otp` so it returns the current code. - For SSH private-key fields, append `?ssh-format=openssh`. 4. Wrap output in a fenced block with a header explaining usage: ``` # Generated for item "ITEM" in vault "VAULT" # Use with: op run --env-file=.env -- <command> USERNAME=op://VAULT/ITEM/username PASSWORD=op://VAULT/ITEM/password API_KEY=op://VAULT/ITEM/Credentials/api_key TOTP=op://VAULT/ITEM/totp?attribute=otp ``` 5. Note any field type that needs special handling (file attachments → `op read --out-file ...` not env, document attachments not supported). ## Edge cases - **Multiple sections with same field name** → include the section name in the reference so the URI is unambiguous. - **Whitespace in vault/item/field names** → wrap the whole reference value in single quotes in the output: `KEY='op://Acme Prod/My Item/api key'`. - **Special characters that secret refs don't allow** → use the field's `id` instead of `label`, and note "(using ID instead of name due to special characters)". - **Item is a Document or has file attachments** → emit a comment line explaining `op read --out-file` is needed instead of env loading. ## On failure - Item not found → suggest `/op-find <query>` to locate it. - Multiple matches (interactive only error) → tell the user to disambiguate by ID or `--vault`.

Frequently asked questions

Op Secret Template