onepassword-agent-secret-flows

Migrate and inject 1Password secrets into agent workflows using op run and vault triage.

Updated Apr 28, 2026
One-click install
npx skills add https://github.com/GregM1991/skills --skill onepassword-agent-secret-flows-gregm1991
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: onepassword-agent-secret-flows
Source: https://github.com/GregM1991/skills/tree/main/skills/onepassword-agent-secret-flows
Command: npx skills add https://github.com/GregM1991/skills --skill onepassword-agent-secret-flows-gregm1991

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Managing API keys and passwords for AI agents risks leaking secrets into transcripts or exposing personal credentials to automation. This Skill provides safe workflows for migrating secrets into 1Password, injecting them at runtime, and triaging large vaults without ever printing secret values. ## Core Features & Use Cases - Secret Injection with op run: Run agent commands that consume secrets via 1Password service accounts instead of printing or storing raw values. - Metadata-First Vault Triage: Generate compact, pre-classified markdown worksheets from op item list metadata so a human can review hundreds of items quickly. - Agent Vault Setup Guidance: Configure an Agents vault with scoped service account permissions (read-only, no vault creation) and safe token file storage. - Use Case: You have a Personal vault with hundreds of items and want to decide which API keys are safe for automation. The Skill exports item metadata, groups items into keep/copy/rotate/archive/delete classes, and produces a review worksheet without exposing any secret values. ## Quick Start Ask the agent to triage your 1Password Personal vault into a safe-automation worksheet using only item metadata.

Frequently Asked Questions about onepassword-agent-secret-flows

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I inject 1Password secrets into agent workflows safely?▼

Use op run with a scoped service account so commands consume secrets at runtime instead of printing them. Store the service account token in a mode-600 env file and reference secrets via op:// vault paths.

How to triage a large 1Password vault for automation-safe secrets?▼

Export item metadata with op item list --long --format json, then group items by signals like category, updatedAt, tags, and title keywords. Produce a pre-classified worksheet with keep, copy, rotate, archive, or delete marks for human review.

Can 1Password updatedAt tell me if a secret is still in use?▼

No, updatedAt only records when an item was last edited, not when a service last used it. Treat it as a weak staleness signal and verify activity through the target service before deleting or rotating.

What permissions should a 1Password service account have for agents?▼

Grant access only to the dedicated Agents vault with Read items enabled, and disable Write items, Share items, and new vault creation. Leave Environment access empty unless deliberately using 1Password Environments.

Which secrets should never be moved into an agent-readable vault?▼

Never migrate recovery codes, banking credentials, identity documents, personal cards, or broad admin and root credentials into an agent vault. Only scoped API keys and bot tokens needed by automation belong there.