1Password Service Account

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:47 PM UTC
• Version: 1.0.2

Overview

This skill is a clearly scoped 1Password CLI helper that handles sensitive secrets, but its behavior is disclosed, purpose-aligned, and focused on safer secret handling.

Install only if you intend to let agents use a scoped 1Password service account. Give the service account the minimum vault/item access needed, review any .env.tpl before use, and avoid running workflows that print environment variables or command output containing secrets.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (9)

Credential Access

High

• Category: Privilege Escalation

Content

Load the token from your platform's secure store:

```bash
# macOS Keychain:
#   security find-generic-password -a <account> -s OP_SERVICE_ACCOUNT_TOKEN -w
# Linux (GNOME Keyring / libsecret):
#   secret-tool lookup service OP_SERVICE_ACCOUNT_TOKEN

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

```bash
# macOS Keychain:
#   security find-generic-password -a <account> -s OP_SERVICE_ACCOUNT_TOKEN -w
# Linux (GNOME Keyring / libsecret):
#   secret-tool lookup service OP_SERVICE_ACCOUNT_TOKEN
# Last resort (interactive prompt, not automatable):
#   read -rs OP_SERVICE_ACCOUNT_TOKEN

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

5. **Never pass secrets as CLI args** (arguments can appear in process lists).
6. **Never pipe secret output to logs/files** (`tee`, `>`, `>>`) unless explicitly writing a protected temporary file for `op inject`.
7. **Never pipe `op read` output into logging pipelines.**
8. **Use `op inject` only with locked-down temp files:** `umask 077`, `chmod 600`, `trap` cleanup.
9. **Never include secret values in chat, tool output, or agent responses.** If a command outputs a secret, do not echo or reference its value.

### Banned Flags/Patterns

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

5. **Never pass secrets as CLI args** (arguments can appear in process lists).
6. **Never pipe secret output to logs/files** (`tee`, `>`, `>>`) unless explicitly writing a protected temporary file for `op inject`.
7. **Never pipe `op read` output into logging pipelines.**
8. **Use `op inject` only with locked-down temp files:** `umask 077`, `chmod 600`, `trap` cleanup.
9. **Never include secret values in chat, tool output, or agent responses.** If a command outputs a secret, do not echo or reference its value.

### Banned Flags/Patterns

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

5. **Never pass secrets as CLI args** (arguments can appear in process lists).
6. **Never pipe secret output to logs/files** (`tee`, `>`, `>>`) unless explicitly writing a protected temporary file for `op inject`.
7. **Never pipe `op read` output into logging pipelines.**
8. **Use `op inject` only with locked-down temp files:** `umask 077`, `chmod 600`, `trap` cleanup.
9. **Never include secret values in chat, tool output, or agent responses.** If a command outputs a secret, do not echo or reference its value.

### Banned Flags/Patterns

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

External Transmission

Medium

• Category: Data Exfiltration

Content

# api-call.sh (chmod +x)
#!/usr/bin/env bash
set -euo pipefail
printf "Authorization: Bearer %s\n" "$API_TOKEN" | curl -sSf -H @- https://api.example.com/health
```

```bash

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

# api-call.sh (chmod +x)
#!/usr/bin/env bash
set -euo pipefail
printf "Authorization: Bearer %s\n" "$API_TOKEN" | curl -sSf -H @- https://api.example.com/health
```

```bash

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

cat > "$TMPFILE" <<'EOF'
SECRET=op://my-vault/my-item/credential
EOF
chmod 600 "$TMPFILE"
op run --env-file="$TMPFILE" -- my-command
```

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

cat > "$TMPFILE" <<'EOF'
SECRET=op://my-vault/my-item/credential
EOF
chmod 600 "$TMPFILE"
op run --env-file="$TMPFILE" -- my-command
```

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Static analysis

No suspicious patterns detected.