# 1Password CLI

Sets up the 1Password CLI for secret references and safe config templating.

- Repository: https://github.com/EKKOLearnAI/ekko-studio (11634 stars)
- Category: DevOps
- License: see repository
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add EKKOLearnAI/ekko-studio --skill 1password -g -a claude-code -y`
Codex: `npx skills add EKKOLearnAI/ekko-studio --skill 1password -g -a codex -y`
Cursor: `npx skills add EKKOLearnAI/ekko-studio --skill 1password -g -a cursor -y`
Gemini CLI: `npx skills add EKKOLearnAI/ekko-studio --skill 1password -g -a gemini-cli -y`

## Description

Set up and use 1Password CLI for authentication, secret references, command injection, and safe configuration templating.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# 1Password CLI

Use the official `op` CLI for secrets consumed by commands or configuration. Prefer workflows in which the secret never appears in model context, terminal output, logs, chat, shell history, or a committed file.

## References

- Read `references/get-started.md` for prerequisites, authentication modes, and platform notes.
- Read `references/cli-examples.md` for safe command patterns.

## Workflow

1. Check the operating system and shell.
2. Verify the CLI without installing anything: `op --version`.
3. Identify the configured authentication mode:
   - `OP_SERVICE_ACCOUNT_TOKEN` is present: service account, usually for CI or headless use.
   - 1Password desktop integration is enabled: use the running, unlocked desktop app.
   - Neither applies: standalone interactive sign-in is required.
4. Verify access with `op whoami` before a secret-consuming operation.
5. If more than one account exists, use `--account` or the already-configured `OP_ACCOUNT` value.
6. Prefer `op run` or `op inject`; use `op read` only when its output can be consumed without being exposed.

If `op` is absent or authentication is not configured, explain the exact prerequisite and point to the official 1Password CLI documentation. Do not silently install the CLI, ask the user to paste a password or token into chat, invent credentials, or place a secret in tool arguments.

## Authentication modes

### Service account

The user must configure `OP_SERVICE_ACCOUNT_TOKEN` outside the conversation and agent command history. Do not print or inspect its value.

```bash
op whoami
op vault list
```

Service-account access is limited to its allowed vaults and does not require the desktop app.

### Desktop app integration

Run `op` directly so it can reach the per-user desktop integration channel:

```bash
op vault list
op whoami
```

The rest: https://github.com/EKKOLearnAI/ekko-studio/blob/HEAD/packages/ekko-agent/skills/1password/SKILL.md