Onepassword

1Password Connect — vaults, items, secrets management for server-side applications.

Security Scan

The skill largely matches its stated purpose (1Password Connect access) but the runtime script reads an unadvertised .env path/WORKSPACE env var and contains a few implementation bugs, so you should review/ sandbox it before giving it real secrets.

Purpose & Capability

Name and description (1Password Connect) align with the required environment variables OP_CONNECT_TOKEN and OP_CONNECT_HOST and with the provided CLI behavior (vaults, items, health). Asking for a Connect token and host is appropriate for this purpose.

Instruction Scope

SKILL.md instructs running the included CLI and documents OP_CONNECT_TOKEN and OP_CONNECT_HOST, but the Python script also attempts to read a .env file from WORKSPACE or ~/.openclaw/workspace/.env when env vars are missing. That file-read behavior is not declared in SKILL.md metadata and could cause the tool to access other local configuration files unexpectedly. The script otherwise only talks to the host specified by OP_CONNECT_HOST.

Install Mechanism

No install spec (instruction-only plus a single Python script). No remote downloads or package installs — lowest install risk.

Credentials

Only OP_CONNECT_TOKEN (primary) and OP_CONNECT_HOST are required, which is proportionate. However the script also reads the WORKSPACE environment variable (if present) and will parse a .env file under that workspace or ~/.openclaw/workspace/.env to look up missing env values. WORKSPACE is not declared in the metadata and reading .env files is an additional implicit source of secrets.

Persistence & Privilege

always is false and the skill does not request to be force-enabled or modify other skills/config. It doesn't persist credentials itself beyond reading envs/.env.

What to consider before installing

This skill appears to implement a simple 1Password Connect CLI and legitimately asks for OP_CONNECT_TOKEN and OP_CONNECT_HOST. Before installing or supplying a real token: 1) Inspect the code yourself (or have someone you trust do it). The script will, if an env var is missing, read WORKSPACE or ~/.openclaw/workspace/.env to obtain values — make sure you don't have unrelated secrets in those files. 2) Confirm OP_CONNECT_HOST points to a trusted 1Password Connect server (do not give your token to an unknown host). 3) Consider testing with a minimally-permissioned token or a throwaway token in a sandboxed agent first. 4) Note the script has some string/placeholder bugs (e.g., inconsistent placeholder names) that may cause commands to fail; that looks like sloppy implementation rather than malicious intent, but it means you should be cautious. If you need higher confidence, ask the publisher for provenance (source repo or official documentation) or run the script in an isolated environment before using production credentials.

🔐 1Password

1Password Connect — vaults, items, secrets management for server-side applications.

Requirements

Variable	Required	Description
OP_CONNECT_TOKEN	✅	1Password Connect token
OP_CONNECT_HOST	✅	1Password Connect server URL

Quick Start

# List all vaults
python3 {{baseDir}}/scripts/onepassword.py list-vaults

# Get vault details
python3 {{baseDir}}/scripts/onepassword.py get-vault <id>

# List items in vault
python3 {{baseDir}}/scripts/onepassword.py list-items --vault-id <value>

# Get item with fields
python3 {{baseDir}}/scripts/onepassword.py get-item --vault-id <value> <id>

# Create item
python3 {{baseDir}}/scripts/onepassword.py create-item --vault-id <value> --category "LOGIN" --title <value> --fields "JSON"

# Update item
python3 {{baseDir}}/scripts/onepassword.py update-item --vault-id <value> <id> --fields "JSON"

# Delete item
python3 {{baseDir}}/scripts/onepassword.py delete-item --vault-id <value> <id>

# Check Connect server health
python3 {{baseDir}}/scripts/onepassword.py get-health

# Simple heartbeat check
python3 {{baseDir}}/scripts/onepassword.py get-heartbeat

Output Format

All commands output JSON by default.

Script Reference

Script	Description
{baseDir}/scripts/onepassword.py	Main CLI — all commands in one tool

Credits

Built by M. Abidi | agxntsix.ai YouTube | GitHub Part of the AgxntSix Skill Suite for OpenClaw agents.

📅 Need help setting up OpenClaw for your business? Book a free consultation