1Password Secret References

Why this skill exists

Coding agents default to the path of least resistance with secrets — resolving them into shell variables, printing them to stdout, or writing them to files. This leaks secrets into terminal scrollback, shell history, the agent's context window, and process tables. This skill enforces a single principle: secrets are resolved only inside the op run subprocess boundary, never in the agent's visible shell.

Prerequisites

• 1Password desktop app installed and running
• 1Password CLI (op) installed and available on PATH
• Biometric unlock enabled (the desktop app authenticates the CLI)

Do not attempt to handle authentication yourself — no session tokens, no op signin, no credentials. If an op run command fails with an authentication error, tell the user: "Please unlock your 1Password desktop app so the CLI can authenticate via biometric."