Skip to main content

1Password

Set up op CLI, sign in, and read or inject secrets.

Skill metadata​

SourceOptional — install with nedura skills install official/security/1password
Pathoptional-skills/security/1password
Version1.0.0
Authorarceus77-7, enhanced by Nedura
LicenseMIT
Platformslinux, macos, windows
Tagssecurity, secrets, 1password, op, cli

Reference: full SKILL.md​

info

The following is the complete skill definition that Nedura loads when this skill is triggered. This is what the agent sees as instructions when the skill is active.

1Password CLI

Use this skill when the user wants secrets managed through 1Password instead of plaintext env vars or files.

Requirements​

  • 1Password account
  • 1Password CLI (op) installed
  • tmux available for stable authenticated sessions during Nedura terminal calls

When to Use​

  • Install or configure 1Password CLI
  • Sign in with op signin
  • Read secret references like op://Vault/Item/field
  • Inject secrets into config/templates using op inject
  • Run commands with secret env vars via op run

Authentication Methods​

Set OP_SERVICE_ACCOUNT_TOKEN in ${NEDURA_HOME:-~/.nedura}/.env (the skill will prompt for this on first load). Supports op read, op inject, op run.

export OP_SERVICE_ACCOUNT_TOKEN="your-token-here"
op whoami  # verify — should show Type: SERVICE_ACCOUNT

Connect Server (self-hosted)​

export OP_CONNECT_HOST="http://localhost:8080"
export OP_CONNECT_TOKEN="your-connect-token"

Setup​

  1. Install CLI:
# macOS
brew install 1password-cli

# Linux (official package/install docs)
# See references/get-started.md for distro-specific links.

# Windows (winget)
winget install AgileBits.1Password.CLI
  1. Verify:
op --version
  1. Choose an auth method above and configure it.

Nedura Execution Pattern​

Nedura terminal commands are non-interactive by default and can lose auth context between calls.

Note: This is NOT needed when using OP_SERVICE_ACCOUNT_TOKEN — the token persists across terminal calls automatically.

SOCKET_DIR="${TMPDIR:-${NEDURA_HOME:-$HOME/.nedura}/cache/scratch}/hermes-tmux-sockets"
mkdir -p "$SOCKET_DIR"
SOCKET="$SOCKET_DIR/hermes-op.sock"
SESSION="op-auth-$(date +%Y%m%d-%H%M%S)"

tmux -S "$SOCKET" new -d -s "$SESSION" -n shell

# Sign in
tmux -S "$SOCKET" send-keys -t "$SESSION":0.0 -- "eval \"\$(op signin --account my.1password.com)\"" Enter

# Verify auth
tmux -S "$SOCKET" send-keys -t "$SESSION":0.0 -- "op whoami" Enter

# Example read
tmux -S "$SOCKET" send-keys -t "$SESSION":0.0 -- "op read 'op://Private/Npmjs/one-time password?attribute=otp'" Enter

# Capture output when needed
tmux -S "$SOCKET" capture-pane -p -J -t "$SESSION":0.0 -S -200

# Cleanup
tmux -S "$SOCKET" kill-session -t "$SESSION"

Common Operations​

Read a secret​

op read "op://app-prod/db/password"

Get OTP​

op read "op://app-prod/npm/one-time password?attribute=otp"

Inject into template​

echo "db_password: {{ op://app-prod/db/password }}" | op inject

Run a command with secret env var​

export DB_PASSWORD="op://app-prod/db/password"  # example op:// reference, resolved by `op run`
op run -- sh -c '[ -n "$DB_PASSWORD" ] && echo "DB_PASSWORD is set" || echo "DB_PASSWORD missing"'

Guardrails​

  • Never print raw secrets back to user unless they explicitly request the value.
  • Prefer op run / op inject instead of writing secrets into files.
  • If command fails with "account is not signed in", run op signin again in the same tmux session.

CI / Headless note​

For non-interactive use, authenticate with OP_SERVICE_ACCOUNT_TOKEN and avoid interactive op signin. Service accounts require CLI v2.18.0+.

References​