onepassword-environment-secrets
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill requires access to sensitive local configuration and credential files, specifically
~/.config/op/service-account-tokenand~/.config/op/environment-id. While this is core to the skill's purpose of 1Password authentication, it involves the agent interacting with high-value secrets. - [COMMAND_EXECUTION]: The instructions utilize shell commands such as
op run --environment "$OP_ENVIRONMENT_ID" -- sh -c 'test -n "$VARIABLE_NAME"'. Executing arbitrary shell commands, even for verification, increases the attack surface if parameters are not strictly controlled. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data (variable names and values) that could contain malicious instructions designed to influence the agent's behavior.
- Ingestion points: Identification of variable names and values from user-provided sources or files (SKILL.md).
- Boundary markers: The instructions do not define clear delimiters or specific warnings to ignore embedded instructions within the variable data.
- Capability inventory: The agent has the ability to execute shell commands, manage files, and interact with the 1Password CLI (SKILL.md).
- Sanitization: There are no explicit requirements for sanitizing or validating variable names or values before they are used in commands or stored.
Audit Metadata