How do I install the 1password skill?

Run npx skillmds@latest add hybridaione/1password in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is 1password safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with 1password?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is 1password free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published 1password?

HybridAIOne (@hybridaione) published this skill. Their other Agent Skills are listed on their SkillMD profile.

1password by hybridaione — Agent Skill

Name: 1password
Author: HybridAIOne

File contents

1Password CLI

Use this skill for host-side secret workflows with 1Password CLI.

Default Workflow

Check whether op is installed:
```
op --version
```
If it is missing, tell the user to run:
```
hybridclaw skill install 1password op
```
or install it manually.
Verify sign-in state:
```
op whoami
op vault list
```
Confirm the exact vault and item before reading any secret.
Prefer secret injection over copying values into files or chat.

Safe Read Patterns

List items:

op item list --vault "Engineering"

Inspect an item without dumping every field:

op item get "Prod API" --vault "Engineering"

Read one field only:

op item get "Prod API" --vault "Engineering" --fields label=password

Read by secret reference:

op read "op://Engineering/Prod API/password"

Safe Injection Patterns

Run a command with secrets injected:

op run --env-file=.env.1password -- your-command

Inject a template into a throwaway runtime file:

RUNTIME_ENV="$(mktemp /tmp/runtime.env.XXXXXX)"
chmod 600 "$RUNTIME_ENV"
trap 'rm -f "$RUNTIME_ENV"' EXIT INT TERM
op inject -i .env.template -o "$RUNTIME_ENV"

Prefer /tmp or an untracked runtime path. Do not inject into tracked files unless the user explicitly asks. If you are done before the shell exits, run rm -f "$RUNTIME_ENV" and trap - EXIT INT TERM.

Rules

Never paste a secret value into chat unless the user explicitly requests it and there is no safer option.
Never commit, log, or echo secrets into shell history on purpose.
Default to read-only operations. Creating or editing vault items needs explicit user confirmation.
If op whoami fails, stop and tell the user they need to unlock the desktop app or sign in again.
If the task only needs a secret for one command, use op run instead of reading the secret into plain text.

---name: 1passworddescription: Install and use 1Password CLI (`op`) to sign in, inspect vault items, read secrets safely, and inject secrets into commands.---# 1Password CLIUse this skill for host-side secret workflows with 1Password CLI.## Default Workflow1. Check whether `op` is installed: ```bash op --version ```2. If it is missing, tell the user to run: ```bash hybridclaw skill install 1password op ``` or install it manually.3. Verify sign-in state: ```bash op whoami op vault list ```4. Confirm the exact vault and item before reading any secret.5. Prefer secret injection over copying values into files or chat.## Safe Read PatternsList items:```bashop item list --vault "Engineering"```Inspect an item without dumping every field:```bashop item get "Prod API" --vault "Engineering"```Read one field only:```bashop item get "Prod API" --vault "Engineering" --fields label=password```Read by secret reference:```bashop read "op://Engineering/Prod API/password"```## Safe Injection PatternsRun a command with secrets injected:```bashop run --env-file=.env.1password -- your-command```Inject a template into a throwaway runtime file:```bashRUNTIME_ENV="$(mktemp /tmp/runtime.env.XXXXXX)"chmod 600 "$RUNTIME_ENV"trap 'rm -f "$RUNTIME_ENV"' EXIT INT TERMop inject -i .env.template -o "$RUNTIME_ENV"```Prefer `/tmp` or an untracked runtime path. Do not inject into tracked files unless the user explicitly asks. If you are done before the shell exits, run `rm -f "$RUNTIME_ENV"` and `trap - EXIT INT TERM`.## Rules- Never paste a secret value into chat unless the user explicitly requests it and there is no safer option.- Never commit, log, or echo secrets into shell history on purpose.- Default to read-only operations. Creating or editing vault items needs explicit user confirmation.- If `op whoami` fails, stop and tell the user they need to unlock the desktop app or sign in again.- If the task only needs a secret for one command, use `op run` instead of reading the secret into plain text.

Frequently asked questions

1password