1password-cli
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from 1Password vaults which is considered untrusted external input.
- Ingestion points: SKILL.md (metadata lookup, secret consumption) and references/cli-usage.md (vault and item discovery).
- Boundary markers: The skill explicitly instructs the agent to minimize secret exposure, avoid using --reveal flags without consent, and prefer references over plaintext values to keep secrets out of the context where possible.
- Capability inventory: The skill uses op run for environment injection and op inject for configuration templating, both of which interact with local system processes and the file system.
- Sanitization: The instructions recommend using --format json and jq to parse metadata safely, ensuring structured data handling.
- [COMMAND_EXECUTION]: The skill enables execution of local op commands and subprocesses via op run. It provides a detailed shell script template for securely handling service account tokens, including the use of restrictive umask 077, mktemp for secure file creation, and trap for cleanup of sensitive materials.
- [DYNAMIC_EXECUTION]: The skill utilize dynamic patterns such as eval "$(op signin)" to manage session authentication and generates temporary JSON templates for item creation and editing to avoid passing secrets as command-line arguments.
Audit Metadata