1password Cli.Bak

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:33 AM UTC
• Version: 1.0.0

Overview

This 1Password skill is coherent and not deceptive, but it needs review because it gives agents broad secret read/write/delete workflows with weak safeguards against accidental credential changes or exposure.

Review this skill before installing. Use a narrowly scoped 1Password service account and dedicated vault, require explicit confirmation before create/edit/delete actions, avoid putting real secrets in command-line arguments, and do not cache retrieved passwords, tokens, or secure notes in plaintext or shared agent storage.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:54
• Finding: Secrets Exposed Through Command-Line Arguments## Vulnerability Details **File Location**: `SKILL.md:54-71` **Vulnerability Type**: Secrets passed as plaintext command-line arguments **Risk Level**: Medium ### Vulnerable Code ```bash op item create --category login --title "My Service" --url "https://example.com" --vault "Vault Name" username="myuser" password="mypassword" ``` ```bash op item create --category "Secure Note" --title "API Key" --vault "Vault Name" notes="my-secret-key" ``` ```bash op item edit "Item Name" password="newpassword" --vault "Vault Name" ``` ### Technical Analysis The documented commands place passwords, API keys, and other sensitive values directly in command-line arguments. Depending on the operating system, shell, agent execution environment, and logging configuration, these values may be exposed through: - Shell history files - Process listings and process-monitoring interfaces - Agent command transcripts - Debug or telemetry logs - Terminal session recording - Error reports that capture complete command invocations Although the commands use the legitimate 1Password CLI, the secrets can escape 1Password's protected storage before being submitted to it. The warning not to print secrets does not prevent command arguments from being recorded by the surrounding shell or agent infrastructure. ### Attack Path 1. An agent follows the documented create or edit example and substitutes a real password or API key. 2. The shell, process monitor, agent runtime, or diagnostic system records or observes the complete command. 3. A local user, administrator, monitoring service, or attacker with access to those records retrieves the plaintext argument. 4. The exposed credential is used to access the associated service or account with the credential's existing privileges. ### Impact Assessment Exploitation can disclose credentials stored or updated through the documented workflow. The resulting privileges depend on the compromis ...[truncated 333 chars]
• Remediation: ## Remediation Suggestions - Replace command-line secret assignments with a 1Password CLI template or JSON-input workflow that avoids including secret values in process arguments. - Where supported, provide sensitive input through a protected standard-input channel rather than the command line. - If a temporary input file is unavoidable, create it with owner-only permissions, store it on an appropriately protected filesystem, and securely remove it immediately after use. - Configure agent runtimes and execution wrappers to redact secret-bearing input and avoid recording full command invocations. - Disable or temporarily suppress shell history for secret-handling operations. - Add an explicit warning that real passwords, tokens, and API keys must not be embedded in command arguments. - Use narrowly scoped credentials and rotate any secret suspected of appearing in process listings, histories, transcripts, or logs.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:85
• Finding: Retrieved Secrets May Be Persisted in an Unprotected Cache## Vulnerability Details **File Location**: `SKILL.md:85` **Vulnerability Type**: Unspecified caching of sensitive vault data **Risk Level**: Medium ### Vulnerable Code ```text - **Rate Limits:** Service accounts have rate limits. Cache results if possible or retry with backoff. ``` ### Technical Analysis The Skill recommends caching command results without distinguishing non-sensitive metadata from retrieved secret values. It does not require encryption, restrictive permissions, expiration, cache isolation, or secure deletion. Because the documented operations include retrieving complete 1Password items and individual secret fields, an agent may interpret this recommendation as permission to persist passwords, tokens, notes, or complete item JSON outside 1Password. Such a cache would bypass the vault's normal access controls and could remain accessible after the intended operation or agent session has ended. ### Attack Path 1. An agent retrieves an item or secret field from 1Password. 2. To reduce service-account API usage, the agent caches the returned result. 3. The cache is written to a local file, shared state store, log-backed workspace, or persistent agent memory without adequate protection. 4. Another user, process, future session, or attacker with access to that storage reads the cached secret. 5. The attacker uses the disclosed credential with its existing privileges. ### Impact Assessment The issue may expose any vault content processed by the agent, including passwords, API keys, secure notes, and complete item metadata. Exposure can persist beyond the original session and may expand access from the narrowly authorized service account to any party able to read the cache. The ultimate privilege and scope depend on the cached secrets. The recommendation does not itself create persistence mechanisms, but it can cause sensitive data to be retained insecurely by an implementing agent.
• Remediation: ## Remediation Suggestions - Remove the general recommendation to cache results from secret-reading operations. - Limit caching to explicitly non-sensitive metadata, such as vault identifiers, only after reviewing the data for sensitive fields. - Prefer retry with bounded exponential backoff and jitter for rate-limit handling. - If caching sensitive data is operationally necessary, require encryption at rest, owner-only access controls, process and tenant isolation, a short time-to-live, and secure deletion. - Prohibit storing retrieved secrets in logs, agent memory, shared workspaces, source-controlled files, or plaintext temporary files. - Document cache invalidation and secret-rotation procedures so stale credentials are not retained.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The skill includes create and edit commands that modify stored credentials and secrets but does not instruct agents to obtain explicit authorization, validate target items, or warn about the consequences of overwriting active credentials. In a privileged secret-management workflow, an agent following these examples could unintentionally rotate, replace, or corrupt credentials and cause outages or lockouts.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill documents a destructive `op item delete` command with no guidance to require explicit user confirmation, dry-run validation, or safeguards against accidental targeting of the wrong item or vault. In a secrets-management context, deletion can remove credentials or recovery data and disrupt services, making omission of safety warnings a real operational security risk.

Static analysis

No suspicious patterns detected.