How do I install the Gateway Env Injector skill?

Run npx skillmds@latest add dvcrn/gateway-env-injector in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Gateway Env Injector safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. Capability flags: executes scripts, makes network calls. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Gateway Env Injector?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Gateway Env Injector free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Gateway Env Injector?

dvcrn (@dvcrn) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Gateway Env Injector by dvcrn — Agent Skill

Name: Gateway Env Injector
Rating: 4.5 (4 reviews)
Author: dvcrn

Gateway Env Injector

Safely inject API keys from 1Password into macOS LaunchAgent plists using PlistBuddy. Use when running OpenClaw on macOS and storing secrets in 1Password — avoids plaintext keys on disk while keeping LaunchAgent env vars populated. Requires 1Password CLI (op).

dvcrn Updated Sep 8, 2026 32 repo stars

File contents

Gateway Environment Injector

Bake secrets from 1Password into macOS LaunchAgent plists without leaving plaintext keys on disk. Uses op read to fetch secrets and /usr/libexec/PlistBuddy to inject them directly into the plist's EnvironmentVariables block.

Why This Exists

launchctl setenv doesn't inject into a plist's own EnvironmentVariables block
Environment variables in .zshrc aren't available to LaunchAgents
Plaintext key files are a security risk
1Password service accounts provide read-only, rotatable access

Usage

bash scripts/inject-gateway-env.sh

Reads each key from 1Password, injects into the gateway plist, then restarts the service.

What It Injects

Configurable list of op://Vault/Item/field references mapped to environment variable names. Modify the script's KEYS array for your setup.

Key Lesson

Changing the Node binary path (even to a symlink) can silently revoke macOS TCC permissions. Always keep the gateway plist locked to the Homebrew Cellar path, not an NVM symlink.

Files

scripts/inject-gateway-env.sh — Injection script with 1Password integration

Frequently asked questions