ClawHub
Back to skill

Security audit

1password.Bak

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for 1Password CLI help, but it includes copyable examples that can expose resolved secrets in terminal output and write secret material to disk without adequate warning.

Install only if you are comfortable letting the agent guide 1Password CLI use. Do not run the `--no-masking` or `printenv DB_PASSWORD` examples with real secrets, avoid sharing tmux captures or terminal logs from secret sessions, and protect any generated files such as keys or rendered configs with restrictive permissions and source-control exclusions.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
references/cli-examples.md:15
Finding

Plaintext Secret Disclosure Through Disabled Output Masking

Content
View full analysis

Vulnerability Details

File Location: references/cli-examples.md, lines 15–17
Vulnerability Type: Plaintext sensitive-data exposure
Risk Level: High

Vulnerable Code

markdown
## Run

- `export DB_PASSWORD="op://app-prod/db/password"`
- `op run --no-masking -- printenv DB_PASSWORD`
- `op run --env-file="./.env" -- printenv DB_PASSWORD`

Technical Analysis

The example resolves a 1Password secret into the DB_PASSWORD environment variable and then executes printenv DB_PASSWORD. The --no-masking option explicitly disables 1Password CLI output masking, causing the resolved database password to be emitted in plaintext.

This practice conflicts with the guardrail in SKILL.md that prohibits placing secrets in logs, chat, or code. Terminal output can be retained in tmux pane history, agent tool results, shell transcripts, CI/CD logs, session recordings, monitoring systems, or copied into conversational context. The adjacent --env-file example also prints the resolved value, although default masking may reduce exposure; secret-consuming commands should never be demonstrated using output utilities such as printenv.

Attack Path

  1. An operator or AI agent follows the documented op run example.
  2. The authenticated 1Password CLI retrieves the secret referenced by op://app-prod/db/password.
  3. op run places the resolved password in the child process environment as DB_PASSWORD.
  4. The --no-masking option disables 1Password's normal output redaction.
  5. printenv DB_PASSWORD writes the plaintext password to standard output.
  6. The output may be captured in tmux scrollback, agent tool output, logs, session recordings, or chat history.
  7. Anyone with access to those retained outputs can reuse the disclosed credential against the corresponding database until it is rotated or revoked.

Impact Assessment

Successful exploitation discloses the selected database credential to ...[truncated 458 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the --no-masking -- printenv DB_PASSWORD example and avoid all examples that print resolved secrets.

  2. Demonstrate op run with an application that consumes the credential without displaying it, for example:

    bash
    export DB_PASSWORD="op://app-prod/db/password"
op run -- database-client --execute-safe-operation

  3. Retain 1Password's default output masking and explicitly prohibit --no-masking whenever command output could contain secrets.

  4. Add a warning that printenv, env, shell tracing (set -x), debug logging, and verbose application modes must not be used with resolved secret values.

  5. Ensure tmux pane captures and agent responses are reviewed to prevent secret-bearing output from entering logs or chat.

  6. If the documented command has already been executed, remove accessible transcripts where feasible, rotate the affected database credential, and review database access logs for unauthorized use.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
98% confidence
Finding

op run --no-masking -- printenv DB_PASSWORD intentionally causes a secret resolved from 1Password to be emitted in cleartext. In the context of a secrets CLI, that materially increases the chance of credential leakage through terminal scrollback, process capture tooling, screen sharing, CI logs, or support transcripts.

Content

Scanner excerpt · references/cli-examples.md (reported line 18)May include surrounding context.

md
## Run

- `export DB_PASSWORD="op://app-prod/db/password"`
- `op run --no-masking -- printenv DB_PASSWORD`
- `op run --env-file="./.env" -- printenv DB_PASSWORD`

## Inject

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
93% confidence
Finding

op run --env-file="./.env" -- printenv DB_PASSWORD demonstrates resolving a secret into an environment variable and then echoing it to output. While less overtly dangerous than the --no-masking variant, it still normalizes exposing secret values and can leak them in local or CI logs.

Content

Scanner excerpt · references/cli-examples.md (reported line 19)May include surrounding context.

md
- `export DB_PASSWORD="op://app-prod/db/password"`
- `op run --no-masking -- printenv DB_PASSWORD`
- `op run --env-file="./.env" -- printenv DB_PASSWORD`

## Inject

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/cli-examples.md (reported line 19)May include surrounding context.

md
- `export DB_PASSWORD="op://app-prod/db/password"`
- `op run --no-masking -- printenv DB_PASSWORD`
- `op run --env-file="./.env" -- printenv DB_PASSWORD`

## Inject

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The examples show secrets being written to local files (--out-file ./key.pem, -o config.yml) without any warning that these outputs persist sensitive material on disk. In documentation for a secrets-management CLI, omission of handling guidance can lead users to create world-readable files, leave secrets in backups, or commit them to source control.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The run examples demonstrate printing a secret-backed environment variable with printenv DB_PASSWORD, including one variant with --no-masking, but provide no warning that this reveals the secret in terminal output, logs, shell history contexts, or CI job records. Because this file is example-driven documentation, users may copy the command directly and unintentionally disclose credentials.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · references/get-started.md (reported line 15)May include surrounding context.

md
- macOS: Settings > Developer > Integrate with 1Password CLI (Touch ID optional).
  - Windows: turn on Windows Hello, then Settings > Developer > Integrate.
  - Linux: Settings > Security > Unlock using system authentication, then Settings > Developer > Integrate.
- After integration, run any command to sign in (example in docs: `op vault list`).
- If multiple accounts: use `op signin` to pick one, or `--account` / `OP_ACCOUNT`.
- For non-integration auth, use `op account add`.

Static analysis

No suspicious patterns detected.