A professional-grade security plugin that enables AI agents to headlessly resolve, read, and write 1Password secrets using service accounts.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install wip-1password
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install wip-1password using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is 1Password Secrets for AI Agents?
The 1Password Secrets skill is a robust security integration designed for developers using Openclaw Skills who need a secure, non-interactive way to manage sensitive credentials. By utilizing the official 1Password JavaScript SDK and service accounts, this skill facilitates fully headless operations, completely removing the need for desktop applications, biometric triggers, or manual browser popups during agent execution.
This tool is essential for maintaining a high security posture in AI-driven environments. It allows agents to interact with encrypted vaults to fetch API keys, rotate tokens, or resolve configuration references on the fly. Because it operates via service accounts, it is perfectly suited for server-side automations, CI/CD pipelines, and remote agent deployments where traditional 1Password authentication is impossible.
1Password Secrets for AI Agents Use Cases
- Automatically resolving op:// secret references within configuration files at agent startup.
- Providing AI agents with secure, real-time access to API keys and tokens stored in 1Password vaults.
- Enabling agents to programmatically save or update credentials in a vault without manual intervention.
- Auditing and listing available vault items to help agents identify the correct credentials for specific tasks.
How 1Password Secrets for AI Agents Works
- The skill initializes by locating a service account token stored at a specific secure local path.
- Upon booting the environment, it parses configuration files for any op:// URI patterns.
- It communicates with the 1Password API to resolve these references directly into the agent's memory, ensuring secrets never touch the disk.
- During active sessions, the skill exposes specific tools to the agent, allowing it to perform read, write, and list operations on custom vaults.
- All sensitive data is handled as volatile variables, preventing accidental leaks into logs or console output.
1Password Secrets for AI Agents Setup
To integrate this skill into your Openclaw Skills workflow, follow these installation and configuration steps:
- Save your 1Password service account token to the required directory:
mkdir -p ~/.openclaw/secrets
echo "your_service_account_token" > ~/.openclaw/secrets/op-sa-token
chmod 600 ~/.openclaw/secrets/op-sa-token
- Enable the plugin and set your default vault in the openclaw.json configuration:
{
"plugins": {
"entries": {
"op-secrets": {
"enabled": true,
"config": {
"defaultVault": "Agent Secrets"
}
}
}
}
}
- Run a test to ensure the connection is established:
openclaw op-secrets test
1Password Secrets for AI Agents Data Schema & Taxonomy
The skill follows a strict data handling policy where no secret values are persisted. The schema and metadata are organized as follows:
| Component | Detail |
|---|---|
| Secret URI | Follows the format: op://vault/item/field |
| Authentication | Uses 1Password Service Account Tokens (headless) |
| Token Storage | Local path at ~/.openclaw/secrets/op-sa-token |
| Target Scopes | Limited to Custom Vaults (Built-in Private/Shared vaults are not supported) |
| Memory Model | Resolves secrets into process.env at runtime only |
1Password Secrets for AI Agents Advanced Features
- Headless SDK integration that bypasses the need for the 1Password CLI or desktop application.
- Native support for Openclaw Skills boot-time resolution of op:// references in JSON configurations.
- Programmable agent tools (op_read_secret, op_write_secret) for dynamic credential management.
- Automatic environment variable injection for key services like OpenAI, handled securely through the memory search remote hook.
- Enforced security rules that prevent the logging of any secret values during agent operations.
SKILL.md
Loading
Related Openclaw Skills
Humanizer Academic Chinese
A specialized AI agent skill designed to humanize Chinese academic writing by removing artificial patterns and restoring authentic scholarly voice.
Handwrytten
Send authentic, robot-written physical cards and notes to recipients using actual pens and paper.
Spendex AI Router
An intelligent LLM gateway that automatically routes prompts to the most cost-effective and high-performing model across 25+ providers.
Tech Report Generator
An automated engine for generating structured technical reports featuring inline SVG visualizations and multi-platform synchronization.
Octopus Deploy
A powerful integration for managing automated deployments, projects, and environments within Octopus Deploy.
Semgrep
A powerful integration that enables AI agents to automate static analysis, manage security policies, and perform deep code scans using Semgrep and Membrane.
Featured*
