1Password Browser Login

• Analyzed: May 8, 2026, 11:01 AM
• Findings: 1
• Version: 1.1.0
• Hash: 2cc2f17c9d3cabd9daadb6b8191a2290595272d627b92eab6e1ef50682651a56
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill automates website logins by retrieving credentials from 1Password via the 'op' CLI and sourcing the user's '~/.zshrc' to access service account tokens. While the instructions in SKILL.md include explicit safety rules to avoid logging or saving passwords, the practice of sourcing shell configuration files and the broad capability to list and retrieve any vault item represent high-risk behaviors that could be exploited to access sensitive data beyond the user's immediate request.