A secure wrapper that dynamically loads SSH private keys from 1Password into an in-memory agent before executing SSH commands.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install ssh-op
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install ssh-op using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is ssh-op?
ssh-op is a specialized utility designed to bridge the gap between secure credential storage and remote server access. By acting as a wrapper for the standard ssh command, it automates the process of fetching private keys directly from a 1Password vault and injecting them into a running ssh-agent.
This Openclaw Skills utility ensures that sensitive private keys are never written to the local disk, providing a significant security upgrade for developers and sysadmins. It facilitates a more secure workflow by keeping keys in-memory and tying the agent's lifetime to the current shell session, minimizing the attack surface for key theft.
ssh-op Use Cases
- Connecting to remote servers without storing unencrypted private keys on a local disk.
- Streamlining the onboarding process for new development machines using 1Password-managed credentials.
- Troubleshooting SSH connection issues within an Openclaw Skills environment.
- Automating the management and synchronization of SSH host aliases within ~/.ssh/config.
How ssh-op Works
- The script first verifies the environment to ensure a local ssh-agent is active for the current shell session.
- It authenticates with 1Password using the op CLI to retrieve the specified private key data.
- The key is piped directly into ssh-add, loading it into the in-memory agent without disk persistence.
- Finally, the script executes the standard ssh command, passing through all user-provided arguments and flags.
ssh-op Setup
Ensure you have the 1Password CLI (op) installed and authenticated. Then, follow these steps to integrate the skill into your workflow:
# 1. Create a symlink for easy access
mkdir -p ~/.local/bin
ln -sf ~/.openclaw/skills/ssh-op/scripts/ssh-op ~/.local/bin/ssh-op
# 2. Run the onboarding script to configure your vault
~/.openclaw/skills/ssh-op/scripts/onboard.sh
# 3. Verify the setup
ssh-op --help
ssh-op Data Schema & Taxonomy
The skill manages configuration and host aliases through a specific file structure within the Openclaw Skills directory:
| File | Purpose |
|---|---|
config.env |
Stores machine-specific variables like SSH_OP_VAULT_NAME and SSH_OP_ITEM_TITLE. |
hosts.conf |
A snippet file containing SSH host entries for automatic injection into the main config. |
~/.ssh/config |
The system-level SSH configuration file updated via idempotent blocks. |
Required configuration keys include SSH_OP_VAULT_NAME and SSH_OP_ITEM_TITLE to identify the source of the private key.
ssh-op Advanced Features
- Fingerprint Validation: If SSH_OP_KEY_FINGERPRINT_SHA256 is set, the skill intelligently skips re-loading keys already present in the agent.
- Idempotent Config Management: Includes a Python script to manage ~/.ssh/config blocks, preventing duplicate entries and maintaining organization.
- Service Account Compatibility: Supports non-interactive environments by utilizing the OP_SERVICE_ACCOUNT_TOKEN within Openclaw Skills.
- Flexible Host Aliasing: Allows users to define custom host snippets in a dedicated hosts.conf file for rapid environment replication.
SKILL.md
Loading
Related Openclaw Skills
Skill Father
The definitive framework for building portable, reproducible, and production-ready Openclaw Skills with guided onboarding flows.
Secure Shopper
An asynchronous AI shopping assistant that researches products across multiple sites and performs secure checkouts using 1Password-backed automation.
Secure Autofill (1Password Integration)
Automate secure web logins using 1Password credentials while keeping secrets private from the AI agent.
queue-task
A durable queue-task helper designed for resumable and idempotent batch processing in task-father environments.
task-father
A generator for file-based task state machines that enables durable, long-running workflows using the OpenClaw workspace.
XClaw Intelligence
A high-performance intelligence layer providing real-time social data, KOL deep analysis, and trending tweet discovery for AI agents.
Featured*
