1password.Old

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:47 AM UTC
• Version: 1.0.0

Overview

This 1Password CLI skill is purpose-aligned but needs Review because its examples can expose real secrets in terminal output or files.

Review this skill carefully before installing. It is not deceptive, but users should avoid copying examples that print secrets, use --no-masking, capture terminal panes after secret access, or write private keys/configs to normal project files. Prefer commands that consume secrets without displaying them, and use restrictive permissions and cleanup whenever secret files are unavoidable.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: references/cli-examples.md:8

Finding

Secrets May Be Exposed Through Unmasked Terminal Output and tmux Pane Capture

Content

View full analysis

Vulnerability Details

File Location: references/cli-examples.md:8-22; related capture behavior in SKILL.md:55
Vulnerability Type: Plaintext sensitive-data exposure
Risk Level: Medium

Vulnerable Code

bash

- `op read op://app-prod/db/password`
- `op read "op://app-prod/db/one-time password?attribute=otp"`
- `op read "op://app-prod/ssh key/private key?ssh-format=openssh"`
- `op read --out-file ./key.pem op://app-prod/server/ssh/key.pem`

## Run

- `export DB_PASSWORD="op://app-prod/db/password"`
- `op run --no-masking -- printenv DB_PASSWORD`
- `op run --env-file="./.env" -- printenv DB_PASSWORD`

## Inject

- `echo "db_password: {{ op://app-prod/db/password }}" | op inject`

The required tmux workflow additionally contains this command at SKILL.md:55:

bash

tmux -S "$SOCKET" capture-pane -p -J -t "$SESSION":0.0 -S -200

Technical Analysis

Several documented examples resolve secrets and print their plaintext values directly to standard output. The op run --no-masking example explicitly disables 1Password's output masking before executing printenv, guaranteeing that the resolved database password is displayed. The op read commands similarly emit passwords, one-time passwords, and private-key material to the terminal. Piping op inject output to the terminal can expose the fully rendered configuration and its embedded secrets.

This behavior becomes more hazardous because SKILL.md requires op commands to run in tmux and demonstrates capturing the last 200 lines of pane output. If a secret-producing example is followed by capture-pane, the plaintext secret can be copied into tool responses, agent context, conversation history, terminal logs, or other retained execution records.

The private-key and injected-file examples can also persist sensitive information on disk without documenting restrictive permissions or cleanup. This contradicts the guardrail in `SKILL ...[truncated 1860 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove examples that display resolved secrets, including direct op read output, printenv, and terminal-directed op inject.
2. Remove --no-masking; do not disable 1Password's output protections in documentation or automated workflows.
3. Demonstrate op run only with programs that consume secrets without printing them, for example:

   bash

   op run --env-file="./.env" -- application-command
   

4. Prohibit tmux capture-pane after any command that could emit a secret. If pane capture is needed for diagnostics, perform it before secret access or capture only known non-sensitive commands.
5. Avoid writing private keys and rendered secret-bearing configuration to disk. Prefer direct in-memory consumption through op run or controlled standard-input pipelines.
6. Where file output is unavoidable, create it in a protected directory with mode 0600, avoid shared temporary paths, verify ownership, and delete it promptly after use.
7. Add an explicit rule that agents must never return resolved secret values in tool output, chat, logs, command traces, or error reports.
8. Add safe validation examples that verify only success or failure without revealing values, and redact any accidental output before it enters retained logs.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 97% confidence

Finding

op run --no-masking -- printenv DB_PASSWORD explicitly disables masking and prints the secret value, which is a direct secret disclosure pattern. In the context of a 1Password CLI skill, this is especially dangerous because users are likely to run the command against real production credentials.

Content

Scanner excerpt · references/cli-examples.md (reported line 18)May include surrounding context.

md

## Run

- `export DB_PASSWORD="op://app-prod/db/password"`
- `op run --no-masking -- printenv DB_PASSWORD`
- `op run --env-file="./.env" -- printenv DB_PASSWORD`

## Inject

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

op run --env-file="./.env" -- printenv DB_PASSWORD demonstrates harvesting and printing a secret from the environment. Even without --no-masking, the example normalizes a workflow that exposes credentials to logs, terminal output, and debugging traces.

Content

Scanner excerpt · references/cli-examples.md (reported line 19)May include surrounding context.

md

- `export DB_PASSWORD="op://app-prod/db/password"`
- `op run --no-masking -- printenv DB_PASSWORD`
- `op run --env-file="./.env" -- printenv DB_PASSWORD`

## Inject

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/cli-examples.md (reported line 19)May include surrounding context.

md

- `export DB_PASSWORD="op://app-prod/db/password"`
- `op run --no-masking -- printenv DB_PASSWORD`
- `op run --env-file="./.env" -- printenv DB_PASSWORD`

## Inject

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The example writes secret material directly to a local file (--out-file ./key.pem) without any warning that the resulting file is sensitive. In a secrets-management skill, users may copy this verbatim and leave private keys on disk with insecure permissions, backup exposure, or accidental commits.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

These examples intentionally materialize a secret into an environment variable and then print it with printenv, including one case with --no-masking. That teaches disclosure of a live secret to terminal history, logs, shell scrollback, CI output, and screen recording without any cautionary context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The inject examples render secrets into stdout and into a concrete file (config.yml) without warning that the produced output now contains plaintext secrets. In practice, that can lead to accidental logging, artifact retention, or committing generated secret-bearing files to source control.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · references/get-started.md (reported line 15)May include surrounding context.

md

- macOS: Settings > Developer > Integrate with 1Password CLI (Touch ID optional).
  - Windows: turn on Windows Hello, then Settings > Developer > Integrate.
  - Linux: Settings > Security > Unlock using system authentication, then Settings > Developer > Integrate.
- After integration, run any command to sign in (example in docs: `op vault list`).
- If multiple accounts: use `op signin` to pick one, or `--account` / `OP_ACCOUNT`.
- For non-integration auth, use `op account add`.

Static analysis

No suspicious patterns detected.