1Password Cli For Agents

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:39 PM UTC
• Version: 0.1.0

Overview

The skill is a coherent 1Password CLI helper, but it gives agents broad secret read/write/delete workflows with insufficient safeguards for handling and mutating credentials.

Install only if you are prepared to tightly limit the 1Password service account to a dedicated vault, require explicit approval before any create/edit/delete action, avoid putting real secrets directly in shell commands, and prohibit persistent caching of retrieved secret values unless it is encrypted, short-lived, and access-controlled.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:52

Finding

Secrets Exposed Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 52-66
Vulnerability Type: Sensitive information exposure through process arguments and shell history
Risk Level: Medium

Vulnerable Code:

bash

op item create --category login --title "My Service" --url "https://example.com" --vault "Vault Name" username="myuser" password="mypassword"

bash

op item create --category "Secure Note" --title "API Key" --vault "Vault Name" notes="my-secret-key"

bash

op item edit "Item Name" password="newpassword" --vault "Vault Name"

Technical Analysis

The documented examples pass passwords and API keys as literal command-line arguments. If an agent replaces these placeholders with genuine credentials, the sensitive values may be exposed through shell history, process-argument inspection, terminal transcripts, command auditing, agent execution logs, telemetry, or debugging output.

Quoting the values does not protect their confidentiality; it only affects shell parsing. Any system capable of recording or inspecting the resulting argument vector may capture the secrets.

Attack Path

1. An agent or user follows an example and substitutes a real password or API key.
2. The command is submitted to the shell with the secret embedded in its arguments.
3. The shell, agent framework, terminal recorder, audit subsystem, or monitoring process records or observes the command.
4. A local user, process, administrator, or log consumer retrieves the exposed value.
5. The recovered credential is used to access the corresponding external account or service.

Impact Assessment

Exploitation does not directly grant additional local privileges, but it may disclose any credential supplied through these commands. The resulting external privileges are those associated with the exposed password or API key and may include access to third-party accounts, APIs, data, or administrative functionality.

T ...[truncated 181 chars]

Remediation

View remediation

Remediation Suggestions

• Do not place real passwords, tokens, API keys, or secure-note contents directly in command-line arguments.
• Use a protected input mechanism supported by the 1Password CLI, such as standard input or a securely generated item template, so secret values do not become part of the argument vector.
• Disable command echoing when handling secrets and ensure sensitive commands are not retained in shell history.
• Configure agent execution frameworks, terminal recorders, telemetry, and audit logging to redact credential values.
• If a temporary file is unavoidable, create it with restrictive permissions, store it on an appropriate protected filesystem, and securely delete it immediately after use.
• Add an explicit warning to the documentation that example placeholders must not be replaced with real secrets directly on the command line.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:82

Finding

Secret Retrieval Results May Be Persisted in Unprotected Caches

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 82
Vulnerability Type: Insecure caching of sensitive information
Risk Level: Medium

Vulnerable Code:

text

-   **Rate Limits:** Service accounts have rate limits. Cache results if possible or retry with backoff.

Technical Analysis

The skill can retrieve complete 1Password item JSON documents, passwords, and other secret fields. It recommends caching results without limiting caching to non-sensitive metadata or defining encryption, access controls, retention periods, isolation, redaction, or secure deletion requirements.

An agent following this guidance may persist plaintext credentials in filesystem caches, shared application state, logs, long-term agent memory, or other durable storage. Such copies can remain available after the original task ends, after access to the vault is revoked, or after a secret is rotated.

Attack Path

1. An agent retrieves a complete vault item or an individual secret through op item get or op read.
2. To reduce service-account API requests, the agent follows the recommendation to cache the result.
3. The result is stored without encryption, restrictive permissions, tenant isolation, or a short expiration time.
4. Another user, process, session, backup system, or log consumer accesses the retained cache.
5. The exposed credential is used with the privileges assigned to the corresponding account or service.

Impact Assessment

A successful disclosure can expose passwords, API keys, secure-note contents, and other fields returned from the authorized vault. The attacker obtains the external privileges associated with the cached credentials rather than automatically obtaining additional operating-system privileges.

The scope may include every sensitive field placed in the cache. Persistence increases the exposure window and can allow unrelated sessions or users to access secrets after the original ret ...[truncated 31 chars]

Remediation

View remediation

Remediation Suggestions

• Prohibit caching retrieved secret values by default.
• Cache only non-sensitive metadata, such as item identifiers or vault names, when necessary.
• Prefer retry with bounded exponential backoff and jitter over persisting secret responses.
• If temporary secret caching is operationally unavoidable, require encrypted ephemeral storage, restrictive access permissions, process or tenant isolation, and a minimal time to live.
• Prevent cached values from entering logs, telemetry, backups, long-term agent memory, or shared state.
• Explicitly erase temporary values after use and invalidate cached data when credentials are rotated or access is revoked.
• Document which response fields are safe to cache and require security review before enabling any persistent secret cache.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly documents item editing and deletion operations for a secrets vault, but it does not instruct the agent to require explicit user confirmation before performing destructive changes. In an agent setting, this increases the risk of accidental secret rotation, deletion, or overwrite caused by ambiguous prompts, automation mistakes, or prompt injection that induces state-changing actions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.