1password Local

• Outcome: Review
• Latest audit: Sep 12, 2026 · 5:31 AM UTC
• Version: 1.0.2

Overview

This 1Password CLI skill is mostly coherent, but it includes examples that can print or persist real secrets in unsafe ways.

Review this skill before installing. It is for a sensitive secrets manager and generally matches that purpose, but users should avoid the examples that print secret values, avoid `--no-masking` for real credentials, and be careful with any command that writes secrets to local files or captures terminal output.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: references/cli-examples.md:17

Finding

Unmasked Secret Disclosure Through Standard Output

Content

View full analysis

Vulnerability Details

File Location: references/cli-examples.md, lines 17–18
Vulnerability Type: Plaintext sensitive-data exposure
Risk Level: High

Vulnerable Code

bash

export DB_PASSWORD="op://app-prod/db/password"
op run --no-masking -- printenv DB_PASSWORD

Technical Analysis

The example passes a 1Password secret reference to op run, explicitly disables 1Password's output masking with --no-masking, and then uses printenv to write the resolved password to standard output.

This behavior conflicts with the guardrail in SKILL.md that prohibits exposing secrets in logs or chat. The prescribed workflow also uses tmux capture-pane, so terminal output generated by this example could subsequently be copied into tool output, execution logs, chat context, or other retained records.

The vulnerability does not independently bypass 1Password authorization. It exposes secrets that the authenticated user or Agent is already authorized to retrieve.

Attack Path

1. The user or Agent authenticates to 1Password and gains access to the referenced vault item.
2. The DB_PASSWORD environment variable is assigned a 1Password secret reference.
3. op run resolves that reference and supplies the plaintext value to its child process.
4. The --no-masking option disables protection that would otherwise mask the secret in command output.
5. printenv DB_PASSWORD emits the plaintext password to the terminal.
6. The output may be retained through tmux pane capture, Agent tooling, terminal logs, chat transcripts, or session observers.
7. A party with access to any retained output can reuse the disclosed credential against systems where it remains valid.

Impact Assessment

Successful exploitation discloses a 1Password-managed credential available to the authenticated account. The resulting access is limited by the privileges of the exposed credential, but it could include database access ...[truncated 372 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the --no-masking -- printenv DB_PASSWORD example.
2. Demonstrate op run with a command that consumes the injected variable without printing it.
3. Retain 1Password's default output masking and explicitly prohibit --no-masking for sensitive values.
4. Do not capture or return terminal panes after commands that might emit secrets.
5. If terminal capture is operationally necessary, inspect and redact the output before storing or returning it.
6. Add guidance warning that secret-bearing environment variables can be exposed through child processes, debugging output, process inspection, or error reports.
7. If this example has already been executed in a recorded environment, remove affected logs and transcripts and rotate the disclosed credential.

A safer conceptual example is:

bash

export DB_PASSWORD="op://app-prod/db/password"
op run -- application-that-consumes-db-password

The invoked application must also be configured not to log the password.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 98% confidence

Finding

The command op run --no-masking -- printenv DB_PASSWORD intentionally resolves a secret into an environment variable and then prints it in cleartext, while disabling masking protections. In practice this is a direct secret disclosure pattern and can leak credentials into logs, transcripts, CI output, or user copy-paste flows.

Content

Scanner excerpt · references/cli-examples.md (reported line 18)May include surrounding context.

md

## Run

- `export DB_PASSWORD="op://app-prod/db/password"`
- `op run --no-masking -- printenv DB_PASSWORD`
- `op run --env-file="./.env" -- printenv DB_PASSWORD`

## Inject

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

The example op run --env-file="./.env" -- printenv DB_PASSWORD still prints the resolved secret value to stdout, even though it is sourced via an env file. This creates a credential exposure path through console output and any downstream logging or process-capture mechanisms.

Content

Scanner excerpt · references/cli-examples.md (reported line 19)May include surrounding context.

md

- `export DB_PASSWORD="op://app-prod/db/password"`
- `op run --no-masking -- printenv DB_PASSWORD`
- `op run --env-file="./.env" -- printenv DB_PASSWORD`

## Inject

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/cli-examples.md (reported line 19)May include surrounding context.

md

- `export DB_PASSWORD="op://app-prod/db/password"`
- `op run --no-masking -- printenv DB_PASSWORD`
- `op run --env-file="./.env" -- printenv DB_PASSWORD`

## Inject

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The examples demonstrate writing secrets or secret-derived configuration to local files such as key.pem and config.yml without warning about persistence, file permissions, or cleanup. This can lead users to store sensitive material unencrypted on disk where it may be recovered by other users, backups, logs, or later compromise.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

These examples expose secret values through environment variables and command output, including use of --no-masking and printenv DB_PASSWORD. Secrets printed to stdout may be captured by terminal history, logs, CI systems, shell recording tools, or observability platforms, increasing the chance of credential disclosure.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · references/get-started.md (reported line 15)May include surrounding context.

md

- macOS: Settings > Developer > Integrate with 1Password CLI (Touch ID optional).
  - Windows: turn on Windows Hello, then Settings > Developer > Integrate.
  - Linux: Settings > Security > Unlock using system authentication, then Settings > Developer > Integrate.
- After integration, run any command to sign in (example in docs: `op vault list`).
- If multiple accounts: use `op signin` to pick one, or `--account` / `OP_ACCOUNT`.
- For non-integration auth, use `op account add`.

Static analysis

No suspicious patterns detected.