A secure integration for AI agents to access 1Password secrets using hardened service account workflows.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install 1password-sa
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install 1password-sa using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is 1Password CLI (Hardened)?
This skill provides a robust and hardened interface for agents to interact with the 1Password CLI. It focuses on the secure injection of secrets into agent workflows, primarily utilizing service accounts to bypass the need for interactive authentication. By standardizing on the op run pattern with environment templates, this skill ensures that sensitive credentials like API keys and database passwords remain protected within the execution environment.
Built for high-security environments, it incorporates strict operational rules to prevent secret leakage in logs, shell history, or agent responses. This makes it an essential component for Openclaw Skills that require access to protected infrastructure or third-party services while maintaining a zero-trust security posture.
1Password CLI (Hardened) Use Cases
- Injecting API keys into automated deployment scripts without exposing them in CI/CD logs.
- Accessing database credentials for secure data processing tasks.
- Managing multi-environment secrets across different vaults for agent-led development.
- Securely fetching certificates or SSH keys for remote server management.
How 1Password CLI (Hardened) Works
- The skill retrieves a 1Password Service Account Token from a secure local store or environment variable.
- Developers define secret references in a .env.tpl file using the op://vault/item/field syntax.
- The agent executes commands through op run, which performs real-time secret injection into the process environment.
- For one-off secret access, the skill utilizes op read within an isolated subshell to ensure immediate cleanup.
- Hardened security logic automatically suppresses shell tracing and enforces output masking to prevent accidental credential exposure.
1Password CLI (Hardened) Setup
To get started with this skill for Openclaw Skills, follow these installation steps:
# Install the 1Password CLI via Homebrew
brew install 1password-cli
# Set up your Service Account Token
export OP_SERVICE_ACCOUNT_TOKEN="your-service-account-token"
# Verify the connection
op whoami
1Password CLI (Hardened) Data Schema & Taxonomy
The skill organizes secret access through structured templates and CLI metadata:
| Component | Description |
|---|---|
| .env.tpl | A configuration template mapping environment variables to 1Password URI references. |
| op:// URI | The standard format for addressing secrets (op://vault-name/item-name/field-name). |
| JSON Metadata | Output from op vault list or op item get used for internal agent diagnostics. |
| Secure Token | The OP_SERVICE_ACCOUNT_TOKEN used for non-interactive session authentication. |
1Password CLI (Hardened) Advanced Features
- Strict validation of vault and item names to prevent shell injection attacks.
- Automated cleanup routines using shell traps to unset tokens and delete temporary files.
- Restricted op inject workflows for creating permission-hardened (chmod 600) temporary config files.
- Support for defense-in-depth masking to redact secrets even if they are accidentally printed to stdout.
SKILL.md
Loading
Related Openclaw Skills
0G Compute Network
Access a decentralized AI inference marketplace with TEE-verified model integrity and on-chain billing.
Codex Autopilot
An automated multi-project orchestration system for Codex CLI using tmux and launchd on macOS.
Solana Swaps
A high-performance DeFi skill for managing Solana wallet balances and executing token swaps via the Jupiter aggregator.
ClawdVine
ClawdVine is an agentic media network for generating AI videos with onchain identity and pay-as-you-go USDC payments.
Kraken Pro
A comprehensive CLI tool for managing Kraken exchange portfolios, trading execution, and staking operations.
SEC Filing Watcher
A real-time monitoring tool for SEC EDGAR filings that delivers summarized financial alerts via Telegram or Slack.
Featured*
