1password-hardened
Pass
Audited by Gen Agent Trust Hub on Apr 21, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill installs the official 1Password CLI using Homebrew, which is an established and well-known package management service.
- [DATA_EXFILTRATION]: The skill includes specific instructions to prevent secrets from being piped to network-transmitting commands (e.g., curl, wget, nc), ensuring that resolved secrets remain on the local machine.
- [COMMAND_EXECUTION]: To mitigate shell injection risks, the skill mandates the use of single quotes around all user-provided arguments, such as vault names, item names, and field labels.
- [SAFE]: The skill uses tmux for session isolation to manage TTY requirements and prevent credential exposure in shared terminal environments, which is a legitimate security best practice for this toolset.
- [DATA_EXFILTRATION]: The documentation identifies and prohibits the use of 'op run --no-masking' to prevent accidental exposure of secrets in process logs or terminal history.
Audit Metadata