ClawHub
Back to skill

Security audit

1password 1.0.1.Zip

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent 1Password CLI helper, but some examples can expose passwords, OTPs, or keys in terminal output, so it needs review before installation.

Install only if you are comfortable letting the agent operate an authenticated 1Password CLI session. Treat the reference examples as unsafe: do not print secret values, disable masking, capture panes containing secrets, or write private keys/configs to ordinary files unless you have explicitly requested it and can protect the output. Prefer commands that pass secrets directly to the consuming program and confirm each secret read or injection target.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
references/cli-examples.md:18
Finding

Plaintext Secret Disclosure Through Disabled Output Masking

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
99% confidence
Finding

The example op run --no-masking -- printenv DB_PASSWORD intentionally causes a resolved secret to be emitted in plaintext to stdout, and --no-masking removes a key safety control designed to reduce accidental disclosure. In practice, this can expose credentials to terminal scrollback, CI logs, shell recording, monitoring tools, or other users on shared systems.

Content

Scanner excerpt · references/cli-examples.md (reported line 18)May include surrounding context.

md
## Run

- `export DB_PASSWORD="op://app-prod/db/password"`
- `op run --no-masking -- printenv DB_PASSWORD`
- `op run --env-file="./.env" -- printenv DB_PASSWORD`

## Inject

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
97% confidence
Finding

The example op run --env-file="./.env" -- printenv DB_PASSWORD demonstrates resolving a secret into an environment variable and then printing it, which directly discloses sensitive material. Even without --no-masking, teaching users to echo secret-bearing environment variables normalizes a leakage pattern that is especially risky in CI/CD, shared shells, and audited environments.

Content

Scanner excerpt · references/cli-examples.md (reported line 19)May include surrounding context.

md
- `export DB_PASSWORD="op://app-prod/db/password"`
- `op run --no-masking -- printenv DB_PASSWORD`
- `op run --env-file="./.env" -- printenv DB_PASSWORD`

## Inject

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/cli-examples.md (reported line 19)May include surrounding context.

md
- `export DB_PASSWORD="op://app-prod/db/password"`
- `op run --no-masking -- printenv DB_PASSWORD`
- `op run --env-file="./.env" -- printenv DB_PASSWORD`

## Inject

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The examples explicitly show secrets being read to stdout and written to local files without any cautionary guidance, including plaintext output of passwords, OTPs, SSH keys, and key material written to disk. In a secrets-management skill, this is dangerous because users commonly copy examples verbatim, which can leak credentials into terminals, shell history, logs, process capture, or insecure filesystem locations.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · references/get-started.md (reported line 15)May include surrounding context.

md
- macOS: Settings > Developer > Integrate with 1Password CLI (Touch ID optional).
  - Windows: turn on Windows Hello, then Settings > Developer > Integrate.
  - Linux: Settings > Security > Unlock using system authentication, then Settings > Developer > Integrate.
- After integration, run any command to sign in (example in docs: `op vault list`).
- If multiple accounts: use `op signin` to pick one, or `--account` / `OP_ACCOUNT`.
- For non-integration auth, use `op account add`.

Static analysis

No suspicious patterns detected.