Agent skill · operations · steipete
1password
Set up and use 1Password CLI for sign-in, desktop integration, and reading or injecting secrets.
Why this skill is useful
Adds detailed workflows and commands for using the 1Password CLI that are not commonly known.
What it needs
Requires 1password-cli installed locally. About 4k tokens when loaded. Last updated 2026-08-07. 385,400 stars on the source repository.
What this skill does
1Password CLI Follow the official CLI get-started steps. Don't guess install commands. References references/get-started.md (install + app integration + sign-in flow) references/cli-examples.md (real op examples) Workflow 1. Check OS + shell. 2. Verify CLI present: op --version. 3. Detect the auth mode the user has set up: Service account: OPSERVICEACCOUNTTOKEN is set (typical for headless setups, CI, gateways). Desktop app integration: the 1Password desktop app is running with CLI integration enabled (typical on macOS / Windows / Linux desktops). Standalone signin: neither of the above — op signin will prompt for an account password every session. 4. Run op according to the auth mode (see below). 5. Verify access: op whoami should succeed before any secret read. 6. If multiple accounts: use --account or OPACCOUNT. Running op per auth mode Service account (preferred for headless / gateway use) Direct exec. No tmux, no signin step. Desktop app integration Direct exec. Do not wrap in tmux — the desktop app integration uses a per-user IPC channel that is established for the gateway's exec environment but is not always reliably reachable from tmux subshells, which run with a different environment context. The transport differs per platform (XPC via the 1Password Browser Helper on macOS, a Unix domain socket on Linux, a named pipe on Windows); the practical rule for an agent is the same on all three: run op directly. On macOS, a useful symptom indicator is the 1Password integration group container at ~/Library/Group Containers/2BUA8C4S2C.com.1password/t/. If a call returns 1Password CLI couldn't connect to the 1Password desktop app, do not switch to tmux. Confirm the desktop app is running and unlocked, then retry direct exec. Standalone signin (no app, interactive password) This is the only mode where tmux helps. op signin prints an eval-style export setting an OPSESSION token for POSIX shells; later commands in the same shell are authenticated by that env var. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills steipete/1password