ClawHub
Back to skill

Security audit

MH 1password

Security checks for vulnerabilities and agentic risk

Overview

This skill is for 1Password CLI use, but its examples can expose real passwords or keys in terminal output and local files, so it needs review before installation.

Install only if you are comfortable with an agent helping operate your 1Password CLI. Do not run the examples that print secrets, disable masking, capture terminal panes after secret output, or write keys/configs to disk unless you have isolated the environment and planned permissions and cleanup.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
references/cli-examples.md:10
Finding

Secret Disclosure Through Plaintext CLI Output and Insecure File Export Examples

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
98% confidence
Finding

op run --no-masking -- printenv DB_PASSWORD resolves the secret into an environment variable and then prints it, which is a direct credential disclosure pattern. This is especially dangerous in shells, CI systems, and shared terminals where stdout may be logged or observed by other users or processes.

Content

Scanner excerpt · references/cli-examples.md (reported line 18)May include surrounding context.

md
## Run

- `export DB_PASSWORD="op://app-prod/db/password"`
- `op run --no-masking -- printenv DB_PASSWORD`
- `op run --env-file="./.env" -- printenv DB_PASSWORD`

## Inject

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The example explicitly disables masking with --no-masking and prints the secret via printenv, causing the secret value to be exposed in terminal output, logs, recordings, or CI job traces. Because this skill is specifically about handling secrets with 1Password, demonstrating unmasked output materially increases the chance users will leak credentials.

Content

No source excerpt is available for this finding.

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
90% confidence
Finding

Using op run --env-file="./.env" -- printenv DB_PASSWORD still demonstrates printing a secret-bearing environment variable, exposing the resolved secret to stdout. Although it does not disable masking explicitly, the example normalizes a workflow where secrets are surfaced in command output rather than consumed safely by an application.

Content

Scanner excerpt · references/cli-examples.md (reported line 19)May include surrounding context.

md
- `export DB_PASSWORD="op://app-prod/db/password"`
- `op run --no-masking -- printenv DB_PASSWORD`
- `op run --env-file="./.env" -- printenv DB_PASSWORD`

## Inject

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/cli-examples.md (reported line 19)May include surrounding context.

md
- `export DB_PASSWORD="op://app-prod/db/password"`
- `op run --no-masking -- printenv DB_PASSWORD`
- `op run --env-file="./.env" -- printenv DB_PASSWORD`

## Inject

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The examples include commands that write secret material to local files and inject secrets into files or stdout without any warning about secure handling. In a secrets-management skill, this can lead users to leave plaintext secrets on disk, in shell history, backups, or world-readable locations, increasing accidental exposure risk.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · references/get-started.md (reported line 15)May include surrounding context.

md
- macOS: Settings > Developer > Integrate with 1Password CLI (Touch ID optional).
  - Windows: turn on Windows Hello, then Settings > Developer > Integrate.
  - Linux: Settings > Security > Unlock using system authentication, then Settings > Developer > Integrate.
- After integration, run any command to sign in (example in docs: `op vault list`).
- If multiple accounts: use `op signin` to pick one, or `--account` / `OP_ACCOUNT`.
- For non-integration auth, use `op account add`.

Static analysis

No suspicious patterns detected.