op-exec

Resolve 1Password op:// references and inject secrets into shell command environments.

3|1|Updated Dec 3, 2025
One-click install
npx skills add https://github.com/nsheaps/ai-mktpl --skill op-exec
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: op-exec
Source: https://github.com/nsheaps/ai-mktpl/tree/main/plugins/1pass/skills/op-exec
Command: npx skills add https://github.com/nsheaps/ai-mktpl --skill op-exec

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

op-exec removes the manual and error-prone steps of resolving 1Password secrets when running shell commands by automatically injecting op:// secret references into the environment before executing processes.

Core Features & Use Cases

  • Resolves environment variables that contain op:// references and injects secrets into the wrapped command's environment.
  • Supports local development, container workflows, and CI/CD pipelines by using interactive sign-in or OP_SERVICE_ACCOUNT_TOKEN for service accounts.
  • Use cases include running deployment scripts that need database credentials, starting Docker Compose with secret environment variables, and automating CI steps that require secure keys.

Quick Start

Run ./deploy.sh while having DATABASE_URL set to an op:// reference so op-exec resolves it and executes the script.

Frequently Asked Questions about op-exec

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I inject 1Password secrets into shell commands?▼

To inject 1Password secrets into shell commands, op-exec automatically resolves op:// vault references in environment variables and passes them to the wrapped process. It executes commands with the necessary credentials securely populated.

Can I use 1Password service account tokens for CI/CD secret injection?▼

Yes, you can use 1Password service account tokens for CI/CD secret injection. op-exec supports the OP_SERVICE_ACCOUNT_TOKEN environment variable to resolve op:// references non-interactively in automated pipelines.

What is the best way to run Docker Compose with 1Password environment variables?▼

The best way to run Docker Compose with 1Password environment variables is wrapping the command with op-exec. It resolves op:// references in your environment before starting containers, ensuring secure secret delivery.

Does op-exec support interactive sign-in for local development?▼

Yes, op-exec supports interactive sign-in for local development. If a service account token is not provided, it resolves op:// secret references by prompting for standard 1Password CLI interactive authentication.

How do I automate deployment scripts that require secure database credentials?▼

You automate deployment scripts requiring secure database credentials by setting environment variables to op:// references and running them through op-exec. It resolves the 1Password entries and executes the script with injected secrets.

Why does my secret injection fail when resolving op:// references in containers?▼

Secret injection resolving op:// references in containers fails if authentication is missing. You must provide a valid OP_SERVICE_ACCOUNT_TOKEN or ensure interactive 1Password CLI sign-in is configured within the container environment.