T09 · Insecure Skill Coding Practices
Error
- Location
references/cli-examples.md:13- Finding
Explicit Disclosure of Unmasked 1Password Secrets
- Content
View full analysis
- Remediation
View remediation
Security audit
1password
Security checks for vulnerabilities and agentic risk
Overview
This 1Password CLI skill has a legitimate purpose, but some documented workflows can expose passwords, private keys, or other secrets in terminal output or local files.
Review carefully before installing. The skill is for a real and sensitive integration, but users should avoid examples that print secrets, disable masking, capture terminal panes after secret commands, or write decrypted secrets into project directories unless they have explicit permissions, restrictive file modes, cleanup, and credential-rotation plans.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:22- Finding
Mandatory tmux Workflow Can Capture Secret-Bearing Terminal Output
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
references/cli-examples.md:8- Finding
Decrypted Secrets May Be Persisted to Unprotected Working-Directory Files
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The examples show workflows that resolve secrets and can expose them directly to stdout or persist them to disk, such as writing a private key with --out-file and printing a secret-derived environment variable. In a reference document for a secrets-management CLI, that is dangerous because users may copy these commands into real environments without understanding the disclosure risk.
- Content
Env Variable Harvesting
High
- Category
- Data Exfiltration
- Confidence
- 96% confidence
- Finding
op run --no-masking -- printenv DB_PASSWORDintentionally resolves a secret into an environment variable and prints it unredacted to stdout. This can disclose the secret to terminal scrollback, shell history tooling, CI logs, or any log collector monitoring command output.- Content
md ## Run - `export DB_PASSWORD="op://app-prod/db/password"` - `op run --no-masking -- printenv DB_PASSWORD` - `op run --env-file="./.env" -- printenv DB_PASSWORD` ## Inject
Env Variable Harvesting
High
- Category
- Data Exfiltration
- Confidence
- 84% confidence
- Finding
op run --env-file="./.env" -- printenv DB_PASSWORDdemonstrates loading secrets from an env file and then printing the resolved secret value. Even without--no-masking, this still models a pattern of exposing secrets through stdout and normalizes handling secrets in a way that may leak through logs or debugging output.- Content
md - `export DB_PASSWORD="op://app-prod/db/password"` - `op run --no-masking -- printenv DB_PASSWORD` - `op run --env-file="./.env" -- printenv DB_PASSWORD` ## Inject
Static analysis
No suspicious patterns detected.