---
name: "1password-cli-developer-secrets"
description: "Inject credentials directly into terminal commands without writing plain .env files."
metadata:
  author: "1Password"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "inject secrets with 1password cli"
  - "use op run command"
  - "reference secrets op://"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

# 1Password CLI Secret Injection in Developer Workflows

Leverages 1Password CLI (op): op run -- command injection, secret references (op://vault/item/field), biometrics authentication, and automated service account tokens in CI.

## When to Invoke
Invoke this skill whenever you need to:
- inject secrets with 1password cli
- use op run command
- reference secrets op://

## Execution SOP & Rules
1. Create .env files containing reference URIs: STRIPE_SECRET_KEY=op://Vault/Item/credential.
2. Run processes using op run --env-file=.env -- command to inject secrets into process memory.
3. Never write resolved secret values back to disk in plain text files.
4. Authenticate with service account tokens (OP_SERVICE_ACCOUNT_TOKEN) in headless CI runners.

## Verification Checklist
- Run local linting, syntax validation, and type-checks before reporting completion.
- Ensure all created or modified files adhere to workspace boundaries and avoid uncommitted secrets.
- Verify tests or build commands exit cleanly with return code 0.