ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

1password Temp

v1.0.0

Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in (single or multi-account), or reading/injecting/...

⭐ 0· 52·0 current·0 all-time
by@hansolero
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
The skill claims to set up and use the 1Password CLI and declares the op binary and a brew install for the official 1password-cli formula, which matches the stated purpose. However, the SKILL.md requires running all op commands inside a fresh tmux session and references a tmux socket convention; yet the registry metadata does not declare tmux as a required binary. That omission is an incoherence: tmux is necessary for the described workflow but not listed as a requirement.
!
Instruction Scope
Instructions tell the agent to create a tmux socket, send interactive signin commands, run op whoami/vault list, capture the tmux pane output (capture-pane -p -J), then kill the session. capture-pane can capture secret-containing output; the SKILL.md does not specify safe handling, storage, or transmission of that captured output. The instructions also direct interactive sign-in automation (sending keys) which relies on desktop app integration and could leak sensitive output if the agent logs the captured pane or transmits it. The doc's insistence on 'never paste secrets into logs/chat' is good but does not prevent accidental capture or subsequent transmission of secrets by the agent.
✓
Install Mechanism
The install spec uses a Homebrew formula '1password-cli' to provide the op binary. This is an expected, low-risk install mechanism for this CLI on systems with Homebrew. No downloads from arbitrary URLs or archive extraction are present.
ℹ
Credentials
The skill does not request credentials or declare required env vars, which is appropriate because interactive sign-in is expected. However, the instructions reference OPENCLAW_TMUX_SOCKET_DIR, TMPDIR and OP_ACCOUNT (and suggest following a 'tmux' skill's socket conventions) without declaring them. The workflow requires filesystem socket creation in /tmp (or OPENCLAW_TMUX_SOCKET_DIR) and may interact with OP_ACCOUNT—these environment uses should be declared or explained.
✓
Persistence & Privilege
always is false and the skill is instruction-only (no code files). It creates transient tmux sessions and socket files and then kills the session; it does not request persistent presence or system-wide config changes. No modifications to other skills' configs are specified.
What to consider before installing
This skill mostly does what it says (help run the 1Password CLI), but there are two issues you should address before installing or using it: (1) The runtime requires tmux but the skill metadata does not declare tmux as a required binary — ensure tmux is present and that the skill's metadata is updated to list it. (2) The instructions capture tmux pane output (capture-pane) which can include secrets; confirm how the agent will handle that captured text (it must not be logged, transmitted, or stored insecurely). Other suggestions: only install the CLI from the official Homebrew formula on trusted machines; run this skill in a single-user, secure environment (not a shared or cloud-hosted agent where captured panes could be exposed); and ask the skill maintainer to (a) declare tmux in required bins, (b) clarify handling of capture-pane output (or avoid capturing secret-bearing panes), and (c) explicitly list any environment variables the instructions depend on (OPENCLAW_TMUX_SOCKET_DIR, OP_ACCOUNT). If the maintainer cannot clarify these points, treat the skill with caution.

Like a lobster shell, security has layers — review code before you run it.

latestvk9708ejp8vcmrveyhcn09sw8cs844mnq

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🔐 Clawdis
Binsop

Install

Install 1Password CLI (brew)
Bins: op
brew install 1password-cli

Comments