1Password Service Account

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:47 PM UTC
• Version: 1.0.2

Overview

This skill is a clearly scoped 1Password CLI helper that handles sensitive secrets, but its behavior is disclosed, purpose-aligned, and focused on safer secret handling.

Install only if you intend to let agents use a scoped 1Password service account. Give the service account the minimum vault/item access needed, review any .env.tpl before use, and avoid running workflows that print environment variables or command output containing secrets.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (9)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.

Load the token from your platform's secure store:

bash

# macOS Keychain:
#   security find-generic-password -a <account> -s OP_SERVICE_ACCOUNT_TOKEN -w
# Linux (GNOME Keyring / libsecret):
#   secret-tool lookup service OP_SERVICE_ACCOUNT_TOKEN

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.

bash

# macOS Keychain:
#   security find-generic-password -a <account> -s OP_SERVICE_ACCOUNT_TOKEN -w
# Linux (GNOME Keyring / libsecret):
#   secret-tool lookup service OP_SERVICE_ACCOUNT_TOKEN
# Last resort (interactive prompt, not automatable):
#   read -rs OP_SERVICE_ACCOUNT_TOKEN

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

md

5. **Never pass secrets as CLI args** (arguments can appear in process lists).
6. **Never pipe secret output to logs/files** (`tee`, `>`, `>>`) unless explicitly writing a protected temporary file for `op inject`.
7. **Never pipe `op read` output into logging pipelines.**
8. **Use `op inject` only with locked-down temp files:** `umask 077`, `chmod 600`, `trap` cleanup.
9. **Never include secret values in chat, tool output, or agent responses.** If a command outputs a secret, do not echo or reference its value.

### Banned Flags/Patterns

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

md

5. **Never pass secrets as CLI args** (arguments can appear in process lists).
6. **Never pipe secret output to logs/files** (`tee`, `>`, `>>`) unless explicitly writing a protected temporary file for `op inject`.
7. **Never pipe `op read` output into logging pipelines.**
8. **Use `op inject` only with locked-down temp files:** `umask 077`, `chmod 600`, `trap` cleanup.
9. **Never include secret values in chat, tool output, or agent responses.** If a command outputs a secret, do not echo or reference its value.

### Banned Flags/Patterns

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

md

5. **Never pass secrets as CLI args** (arguments can appear in process lists).
6. **Never pipe secret output to logs/files** (`tee`, `>`, `>>`) unless explicitly writing a protected temporary file for `op inject`.
7. **Never pipe `op read` output into logging pipelines.**
8. **Use `op inject` only with locked-down temp files:** `umask 077`, `chmod 600`, `trap` cleanup.
9. **Never include secret values in chat, tool output, or agent responses.** If a command outputs a secret, do not echo or reference its value.

### Banned Flags/Patterns

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 170)May include surrounding context.

api-call.sh (chmod +x)

#!/usr/bin/env bash set -euo pipefail printf "Authorization: Bearer %s\n" "$API_TOKEN" | curl -sSf -H @- https://api.example.com/health

text

```bash

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/cli-examples.md (reported line 75)May include surrounding context.

api-call.sh (chmod +x)

#!/usr/bin/env bash set -euo pipefail printf "Authorization: Bearer %s\n" "$API_TOKEN" | curl -sSf -H @- https://api.example.com/health

text

```bash

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 209)May include surrounding context.

cat > "$TMPFILE" <<'EOF' SECRET=op://my-vault/my-item/credential EOF chmod 600 "$TMPFILE" op run --env-file="$TMPFILE" -- my-command

text

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-examples.md (reported line 95)May include surrounding context.

cat > "$TMPFILE" <<'EOF' SECRET=op://my-vault/my-item/credential EOF chmod 600 "$TMPFILE" op run --env-file="$TMPFILE" -- my-command

text

Static analysis

No suspicious patterns detected.