skills.rest
bravros
bravrosOFFICIAL
Explore all skills by this author →
WebsiteGitHub

onepass

Manage and rotate secrets through the 1Password CLI using op:// references.

3|Updated Apr 11, 2026
Search Tags:#devops#security#secrets management#credential rotation#1password#op cli#env injection
One-click install
npx skills add https://github.com/bravros/bravros --skill onepass-bravros
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: onepass
Source: https://github.com/bravros/bravros/tree/main/plugins/tools/skills/onepass
Command: npx skills add https://github.com/bravros/bravros --skill onepass-bravros

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve? Hardcoded secrets in .env files and committed plaintext credentials are a constant security risk. This Skill enforces a workflow where secrets live only in 1Password and code holds only op:// references, covering creation, injection, and rotation of credentials via the op CLI. ## Core Features & Use Cases - Preflight and auth detection: Scripts detect whether the machine uses desktop (biometric) or service-account auth, auto-install the op CLI on macOS/Linux, and guide auth setup in a separate terminal. - Safe secret creation: Enforces ASCII-only item titles, required metadata fields (credential, token type, permissions, owner, rotated date), and validates that op:// references resolve before finishing. - Injection and rotation workflows: Wire projects with op run --env-file, rotate credentials in place while keeping item IDs stable, propagate to sinks like GitHub/Vercel/Cloudflare, and revoke old tokens at the provider. - Use Case: You inherit a repo with plaintext API keys in .env. The Skill greps for secrets, creates properly tagged 1Password items, replaces values with op:// references, and prefixes dev scripts with op run so secrets never touch disk again. ## Quick Start Load the environment variables for this project from 1Password and replace any plaintext secrets in my .env file with op:// references.

Frequently Asked Questions about onepass

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I inject secrets from 1Password into my project?▼

Use op run --env-file=.env -- <command> where the .env file contains only VAR=op://Vault/Item/field references, which is safe to commit. For one-shot use, run TOKEN="$(op read 'op://...')" directly before your command.

How do I rotate an API token stored in 1Password?▼

Edit the existing item with op item edit <ID> "credential[password]=<NEW>" and update the rotated date field, keeping the same item ID so references keep working. Then propagate to the sinks listed in the used by field and revoke the old token at the provider.

Can I use the 1Password CLI in CI or headless environments?▼

Yes, use a service account by exporting OP_SERVICE_ACCOUNT_TOKEN. Service accounts should use vault and item UUIDs instead of names to cut API calls, and you can check limits with op service-account ratelimit before long jobs.

Why does my op:// secret reference fail with an invalid character error?▼

References fail when item titles or field labels contain non-ASCII characters like em-dashes, parentheses, or emoji. Titles must use only ASCII letters, digits, spaces, hyphens, and underscores; the validate-title.sh script checks and suggests a safe rewrite.

What is the difference between desktop and service-account auth for op?▼

Desktop auth uses the 1Password app integration with Touch ID or system auth for interactive sessions, verified with op whoami. Service-account auth uses a token for headless runs, verified with op user get --me, and takes precedence when both are set.

Related Skills

Explore More Software Engineering Skills→
danmestasdanmestas
4

doppler

Migrate plaintext .env secrets to Doppler-managed secrets via the Doppler CLI.

Community
Advanced
arcasilesgrouparcasilesgroup
54

ai-pipeline

Generate stack-aware CI/CD workflow files for GitHub Actions and Azure Pipelines.

Official
Advanced
somachaksomachak

auditing-secrets-and-config

Audit code, configuration, and CI/CD pipelines for exposed secrets.

Community
Intermediate
Camilo8902Camilo8902

env-secrets-manager

Manage environment variables and secrets with encryption, rotation, and provider integration.

Community
Advanced