1Password CLI

Use this skill to operate 1Password CLI with least privilege and low transcript exposure.

Default Stance

Prefer op run with secret references over reading plaintext secret values.
Prefer a scoped 1Password service account for unattended agent or automation work.
Prefer app-integrated interactive sign-in for local, human-present workflows.
Never print, summarize, paste, commit, or store secret values in chat, logs, notes, diffs, shell history, screenshots, or generated docs.
Treat anything that reaches the transcript as exposed. If a secret was printed, tell the user to rotate it.

Before touching secrets, establish what is needed: