The Agent Skills Directory

[PERSISTENCE]: The skill provides scripts and instructions that modify system and shell configurations to maintain plugin functionality. Specifically, scripts/setup-gh-plugin.sh modifies the global git credential helper, and SKILL.md instructs users to source plugin scripts in ~/.zshrc or ~/.bashrc to ensure 1Password integration persists across shell sessions.
[DYNAMIC_EXECUTION]: The setup script scripts/setup-gh-plugin.sh utilizes eval $(op signin) to process user authentication. This pattern involves executing the output of a command as code, which is a dynamic execution risk.
[INDIRECT_PROMPT_INJECTION]: The environment management utilities ingest and parse untrusted data from local .env files, which could be used to inject malicious instructions into the agent's workflow.
Ingestion points: tools/src/op-env-create.ts and tools-python/src/op_env/op_env_create.py both implement logic to read and parse variables from user-provided files.
Boundary markers: None identified; the parsing logic does not implement specific delimiters or instructions to prevent the agent from following directives embedded within the environment variable values.
Capability inventory: The skill has broad capabilities including reading, creating, and deleting items in 1Password vaults, writing to local files, and executing CLI commands through the op, gh, and git tools.
Sanitization: The tools use standard regex for key-value extraction but lack sanitization for prompt injection patterns.
[DATA_EXFILTRATION]: The op-env-export tool facilitates the transition of concealed secrets from secure 1Password storage to plain-text local files (.env). While intended for development workflows, this functionality creates a significant data exposure risk if the resulting files are not properly secured or are accidentally committed to version control.
[COMMAND_EXECUTION]: The TypeScript and Python tools extensively utilize subprocess execution (via Bun.spawn and asyncio.create_subprocess_exec) to interact with the 1Password CLI and other development tools based on user-provided arguments like vault names and item titles.

1password