1password

1---2name: 1password3description: Set up op CLI, sign in, and read or inject secrets.4version: 1.0.05author: arceus77-7, enhanced by Hermes Agent6license: MIT7platforms: [linux, macos, windows]8metadata:9  hermes:10    tags: [security, secrets, 1password, op, cli]11    category: security12setup:13  help: "Create a service account at https://my.1password.com → Settings → Service Accounts"14  collect_secrets:15    - env_var: OP_SERVICE_ACCOUNT_TOKEN16      prompt: "1Password Service Account Token"17      provider_url: "https://developer.1password.com/docs/service-accounts/"18      secret: true19---20 21# 1Password CLI22 23Use this skill when the user wants secrets managed through 1Password instead of plaintext env vars or files.24 25## Requirements26 27- 1Password account28- 1Password CLI (`op`) installed29- One of: desktop app integration, service account token (`OP_SERVICE_ACCOUNT_TOKEN`), or Connect server30- `tmux` available for stable authenticated sessions during Hermes terminal calls (desktop app flow only)31 32## When to Use33 34- Install or configure 1Password CLI35- Sign in with `op signin`36- Read secret references like `op://Vault/Item/field`37- Inject secrets into config/templates using `op inject`38- Run commands with secret env vars via `op run`39 40## Authentication Methods41 42### Service Account (recommended for Hermes)43 44Set `OP_SERVICE_ACCOUNT_TOKEN` in `${HERMES_HOME:-~/.hermes}/.env` (the skill will prompt for this on first load).45No desktop app needed. Supports `op read`, `op inject`, `op run`.46 47```bash48export OP_SERVICE_ACCOUNT_TOKEN="your-token-here"49op whoami  # verify — should show Type: SERVICE_ACCOUNT50```51 52### Desktop App Integration (interactive)53 541. Enable in 1Password desktop app: Settings → Developer → Integrate with 1Password CLI552. Ensure app is unlocked563. Run `op signin` and approve the biometric prompt57 58### Connect Server (self-hosted)59 60```bash61export OP_CONNECT_HOST="http://localhost:8080"62export OP_CONNECT_TOKEN="your-connect-token"63```64 65## Setup66 671. Install CLI:68 69```bash70# macOS71brew install 1password-cli72 73# Linux (official package/install docs)74# See references/get-started.md for distro-specific links.75 76# Windows (winget)77winget install AgileBits.1Password.CLI78```79 802. Verify:81 82```bash83op --version84```85 863. Choose an auth method above and configure it.87 88## Hermes Execution Pattern (desktop app flow)89 90Hermes terminal commands are non-interactive by default and can lose auth context between calls.91For reliable `op` use with desktop app integration, run sign-in and secret operations inside a dedicated tmux session.92 93Note: This is NOT needed when using `OP_SERVICE_ACCOUNT_TOKEN` — the token persists across terminal calls automatically.94 95```bash96SOCKET_DIR="${TMPDIR:-/tmp}/hermes-tmux-sockets"97mkdir -p "$SOCKET_DIR"98SOCKET="$SOCKET_DIR/hermes-op.sock"99SESSION="op-auth-$(date +%Y%m%d-%H%M%S)"100 101tmux -S "$SOCKET" new -d -s "$SESSION" -n shell102 103# Sign in (approve in desktop app when prompted)104tmux -S "$SOCKET" send-keys -t "$SESSION":0.0 -- "eval \"\$(op signin --account my.1password.com)\"" Enter105 106# Verify auth107tmux -S "$SOCKET" send-keys -t "$SESSION":0.0 -- "op whoami" Enter108 109# Example read110tmux -S "$SOCKET" send-keys -t "$SESSION":0.0 -- "op read 'op://Private/Npmjs/one-time password?attribute=otp'" Enter111 112# Capture output when needed113tmux -S "$SOCKET" capture-pane -p -J -t "$SESSION":0.0 -S -200114 115# Cleanup116tmux -S "$SOCKET" kill-session -t "$SESSION"117```118 119## Common Operations120 121### Read a secret122 123```bash124op read "op://app-prod/db/password"125```126 127### Get OTP128 129```bash130op read "op://app-prod/npm/one-time password?attribute=otp"131```132 133### Inject into template134 135```bash136echo "db_password: {{ op://app-prod/db/password }}" | op inject137```138 139### Run a command with secret env var140 141```bash142export DB_PASSWORD="op://app-prod/db/password"  # example op:// reference, resolved by `op run`143op run -- sh -c '[ -n "$DB_PASSWORD" ] && echo "DB_PASSWORD is set" || echo "DB_PASSWORD missing"'144```145 146## Guardrails147 148- Never print raw secrets back to user unless they explicitly request the value.149- Prefer `op run` / `op inject` instead of writing secrets into files.150- If command fails with "account is not signed in", run `op signin` again in the same tmux session.151- If desktop app integration is unavailable (headless/CI), use service account token flow.152 153## CI / Headless note154 155For non-interactive use, authenticate with `OP_SERVICE_ACCOUNT_TOKEN` and avoid interactive `op signin`.156Service accounts require CLI v2.18.0+.157 158## References159 160- `references/get-started.md`161- `references/cli-examples.md`162- https://developer.1password.com/docs/cli/163- https://developer.1password.com/docs/service-accounts/164