1password

• Outcome: Review
• Latest audit: Sep 15, 2026 · 9:23 PM UTC
• Version: 1.0.0

Overview

This 1Password CLI skill is mostly coherent, but its examples can cause an agent to print or write real secrets without enough warning.

Review before installing. Use this only if you are comfortable giving the agent access to your 1Password CLI context, and avoid the unsafe examples that print secrets or write private keys/configs to the working directory unless you add strict permissions, cleanup, and logging controls.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: references/cli-examples.md:16

Finding

Plaintext Secret Disclosure Through Standard Output

Content

View full analysis

Vulnerability Details

File Location: references/cli-examples.md, lines 16 and 20
Vulnerability Type: Plaintext sensitive-data exposure
Risk Level: High

Vulnerable Code

bash

op run --no-masking -- printenv DB_PASSWORD

bash

echo "db_password: {{ op://app-prod/db/password }}" | op inject

Technical Analysis

The first command explicitly disables 1Password's output masking and passes a database password to printenv, causing the resolved secret to be written to standard output. The second command sends an injected configuration containing the resolved database password to standard output.

In an agent, CI, gateway, or terminal-automation environment, standard output may be retained in execution logs, terminal captures, chat transcripts, or monitoring systems. These examples therefore conflict with the guardrail in SKILL.md that says secrets must never be pasted into logs, chat, or code.

Attack Path

1. A user or automated agent follows one of the documented examples.
2. The authenticated op process retrieves the referenced database password.
3. --no-masking causes printenv to display the real value, or op inject emits the resolved configuration.
4. The execution platform records standard output.
5. A person or service with access to the retained output obtains the plaintext credential.
6. The exposed credential can then be used against every database or service for which it remains valid.

Impact Assessment

The exposure does not itself grant additional local operating-system privileges. It can grant the application or database privileges associated with the disclosed credential, potentially including unauthorized data access, modification, or deletion. The scope depends on the credential's permissions, reuse, validity period, and the readership of captured output.

Remediation

View remediation

Remediation Suggestions

• Remove the --no-masking -- printenv DB_PASSWORD example.
• Do not demonstrate successful secret injection by printing the resolved value.
• Use op run to pass secrets directly to the intended process while retaining masking.
• If an example must verify injection, have the child process report only whether the variable is populated, never its value.
• Add an explicit warning that agent output, CI logs, terminal captures, and chat transcripts must be treated as disclosure channels.
• Rotate any credential that has already been exposed through captured output.

T09 · Insecure Skill Coding Practices

Warning

• Location: references/cli-examples.md:11

Finding

Secret Files Written Without Explicit Permission Hardening

Content

View full analysis

Vulnerability Details

File Location: references/cli-examples.md, lines 11 and 21
Vulnerability Type: Insecure plaintext secret-file creation
Risk Level: Medium

Vulnerable Code

bash

op read --out-file ./key.pem op://app-prod/server/ssh/key.pem

bash

op inject -i config.yml.tpl -o config.yml

Technical Analysis

These examples persist an SSH private key and a secret-bearing generated configuration to ordinary working-directory paths without instructing the user to apply restrictive permissions, select a protected destination, or remove the files after use.

The resulting access mode depends on the CLI's file-creation behavior and the process umask. The documentation does not establish that only the owner can read the files. Persistent output can also be copied into backups, build artifacts, container contexts, or source-control commits. This undermines the preference in SKILL.md for op run or op inject over writing secrets to disk.

Attack Path

1. A user or agent executes one of the documented output-file commands.
2. 1Password resolves the private key or template references and writes plaintext data into the current working directory.
3. The file remains accessible according to its effective permissions and directory controls.
4. Another local user, process, artifact collector, backup service, or repository operation obtains the file.
5. The exposed private key or application credentials are used to access systems authorized for that secret.

Impact Assessment

Disclosure of the SSH private key can grant remote access at the privilege level of the corresponding SSH account, subject to server-side restrictions and any key passphrase. Disclosure of an injected configuration can grant access to each service represented by credentials in that file. The affected scope may extend beyond the local host to production infrastructure, databases, or external services.

Remediation

View remediation

Remediation Suggestions

• Prefer op run or direct process substitution so plaintext secrets are not persisted.
• Where a file is required, create it in a private directory and enforce owner-only access, for example by setting umask 077 before creation and verifying mode 0600.
• Avoid predictable shared temporary paths; use securely created temporary files or directories.
• Ensure generated secret files are excluded from source control, build contexts, artifacts, and backups.
• Delete files promptly after use and document their lifecycle.
• Clarify whether op --out-file safely handles existing files, symbolic links, and permissions before recommending it for sensitive material.
• Rotate keys or credentials if generated files may already have been exposed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 96% confidence

Finding

op run --no-masking -- printenv DB_PASSWORD resolves the secret reference and prints the actual database password in plaintext. This is a direct secret exposure pattern that can leak credentials to console logs, CI logs, shell history captures, telemetry, and any observer of the session.

Content

Scanner excerpt · references/cli-examples.md (reported line 18)May include surrounding context.

md

## Run

- `export DB_PASSWORD="op://app-prod/db/password"`
- `op run --no-masking -- printenv DB_PASSWORD`
- `op run --env-file="./.env" -- printenv DB_PASSWORD`

## Inject

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

Although this variant uses --env-file, the example still culminates in printenv DB_PASSWORD, which displays the resolved secret value to stdout. The presence of an env file can make this more dangerous by encouraging broader secret loading while still teaching users to reveal the value directly.

Content

Scanner excerpt · references/cli-examples.md (reported line 19)May include surrounding context.

md

- `export DB_PASSWORD="op://app-prod/db/password"`
- `op run --no-masking -- printenv DB_PASSWORD`
- `op run --env-file="./.env" -- printenv DB_PASSWORD`

## Inject

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/cli-examples.md (reported line 19)May include surrounding context.

md

- `export DB_PASSWORD="op://app-prod/db/password"`
- `op run --no-masking -- printenv DB_PASSWORD`
- `op run --env-file="./.env" -- printenv DB_PASSWORD`

## Inject

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

bash

SOCKET_DIR="${OPENCLAW_TMUX_SOCKET_DIR:-${TMPDIR:-/tmp}/openclaw-tmux-sockets}"
mkdir -p "$SOCKET_DIR"
chmod 700 "$SOCKET_DIR"
SOCKET="$SOCKET_DIR/openclaw-op.sock"
SESSION="op-auth-$(date +%Y%m%d-%H%M%S)"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The documentation includes examples that write secret material to disk, such as --out-file ./key.pem and rendering templates to config.yml, but does not warn about filesystem persistence, file permissions, cleanup, or accidental commits. For secret-handling documentation, omission of these safeguards increases the chance that users leave sensitive material on disk where it can be read by other users, backup systems, or source control.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The examples explicitly demonstrate op run --no-masking together with printenv DB_PASSWORD, which causes a resolved secret to be printed to stdout in cleartext. In a secrets-management skill, showing disclosure patterns without strong warning text can normalize unsafe handling and lead to accidental exposure in terminals, logs, scrollback, CI output, or screen recordings.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · references/get-started.md (reported line 15)May include surrounding context.

md

- macOS: Settings > Developer > Integrate with 1Password CLI (Touch ID optional).
  - Windows: turn on Windows Hello, then Settings > Developer > Integrate.
  - Linux: Settings > Security > Unlock using system authentication, then Settings > Developer > Integrate.
- After integration, run any command to sign in (example in docs: `op vault list`).
- If multiple accounts: use `op signin` to pick one, or `--account` / `OP_ACCOUNT`.
- For non-integration auth, use `op account add`.
- Desktop app integration uses a per-user IPC channel the CLI must reach. The transport differs per platform (XPC via the 1Password Browser Helper on macOS, a Unix domain socket on Linux, a named pipe on Windows). Run `op` directly from the gateway's exec environment; wrapping in tmux can move the call into a different environment context where the IPC channel is unreachable, producing `1Password CLI couldn't connect to the 1Password desktop app` errors.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/cli-examples.md:17