HermesBELARABI
العربيةSearch/CheckingSign in
AcademyDirectorySolutionsStudioProjectsCompareSearch Releases Pricing Account Sign in
Directory → SKILL
SKILLoptionalHermes Optional Skills

1Password

Set up op CLI, sign in, and read or inject secrets

securitysecrets1passwordopcliOptionalHermes skill
Last registry verification2026-08-18v1.0.0arceus77-7, enhanced by Hermes Agent
Open original source ↗اقرأ بالعربية
Plain meaning

What does it add to Hermes?

Set up op CLI, sign in, and read or inject secrets

1Password is a skill related to security and identity. It focuses on risk checks or access management. These tools are sensitive because they may see account or infrastructure information.

This plain-language explanation is based on the publisher description. The original text remains visible for verification.

Use it when

Use it when your goal in security and identity is clear and you can limit it to the data and actions it actually needs.

Skip it when

Do not add it merely to experiment when Hermes already has a simpler path, or when you cannot review its source and permissions.

Who is it for?

Best for users who want a repeatable way of working inside Hermes.

Safe first test

Use test data or read-only access and confirm findings include evidence without automatic action.

Original publisher description

Set up op CLI, sign in, and read or inject secrets

✓
Data source

This entry was indexed from Hermes Optional Skills. Our explanation interprets the type and domain without inventing a capability not present upstream.

!
Security review

The source is official or editorially reviewed, but you still need to review permissions and version compatibility.

Safe setup path

Inspect, install, then test.

  1. 01
    Open the source

    Match the publisher, license, and description to your need. Check the real update history.

  2. 02
    Review permissions and secrets

    Never paste a secret value into this site. Use environment-variable names and grant the smallest scope.

  3. 03
    Copy setup only after review

    The controls below copy text. They do not execute commands on your device.

  4. 04
    Test with a non-sensitive task

    Inspect the visible tools, then exclude write or delete tools you do not need.

Install command

Review the command, then copy it.

hermes skills install 1password

Hermes Belarabi does not execute this command. Installation happens on your device and remains subject to Hermes scanning and your review.

The full skill definition

Exactly what Hermes loads when this skill runs.

Reproduced from the official documentation. Read it before enabling the skill: this text becomes the agent's instructions.

Set up op CLI, sign in, and read or inject secrets.

Skill metadata

A lookup table. Do not read it all; find the row that applies to you.

SourceOptional — install with hermes skills install official/security/1password
Pathoptional-skills/security/1password
Version1.0.0
Authorarceus77-7, enhanced by Hermes Agent
LicenseMIT
Platformslinux, macos, windows
Tagssecurity, secrets, 1password, op, cli

Reference: full SKILL.md

Explains the idea itself. Read it slowly; the later sections build on it.

Use this skill when the user wants secrets managed through 1Password instead of plaintext env vars or files.

Requirements

Explains the idea itself. Read it slowly; the later sections build on it.

  • 1Password account
  • 1Password CLI (op) installed
  • One of: desktop app integration, service account token (OP_SERVICE_ACCOUNT_TOKEN), or Connect server
  • tmux available for stable authenticated sessions during Hermes terminal calls (desktop app flow only)

When to Use

Explains the idea itself. Read it slowly; the later sections build on it.

  • Install or configure 1Password CLI
  • Sign in with op signin
  • Read secret references like op://Vault/Item/field
  • Inject secrets into config/templates using op inject
  • Run commands with secret env vars via op run

Authentication Methods

Settings you configure once. Change one at a time so you can see what each does. Set SERVICE_ACCOUNT in your environment, not in the chat.

Set OP_SERVICE_ACCOUNT_TOKEN in ${HERMES_HOME:-~/.hermes}/.env (the skill will prompt for this on first load). No desktop app needed. Supports op read, op inject, op run.

Shell2 lines
export OP_SERVICE_ACCOUNT_TOKEN="your-token-here"
op whoami  # verify — should show Type: SERVICE_ACCOUNT

Desktop App Integration (interactive)

  1. Enable in 1Password desktop app: Settings → Developer → Integrate with 1Password CLI
  2. Ensure app is unlocked
  3. Run op signin and approve the biometric prompt

Connect Server (self-hosted)

Shell2 lines
export OP_CONNECT_HOST="http://localhost:8080"
export OP_CONNECT_TOKEN="your-connect-token"

Setup

Ordered, practical steps. Run one and confirm it worked before moving on.

  1. Install CLI:
Shell8 lines
# macOS
brew install 1password-cli

# Linux (official package/install docs)
# See references/get-started.md for distro-specific links.

# Windows (winget)
winget install AgileBits.1Password.CLI
  1. Verify:
Shell1 line
op --version
  1. Choose an auth method above and configure it.

Hermes Execution Pattern (desktop app flow)

Settings you configure once. Change one at a time so you can see what each does. Set SOCKET_DIR in your environment, not in the chat.

Hermes terminal commands are non-interactive by default and can lose auth context between calls. For reliable op use with desktop app integration, run sign-in and secret operations inside a dedicated tmux session.

Note: This is NOT needed when using OP_SERVICE_ACCOUNT_TOKEN — the token persists across terminal calls automatically.

Shell21 lines
SOCKET_DIR="${TMPDIR:-/tmp}/hermes-tmux-sockets"
mkdir -p "$SOCKET_DIR"
SOCKET="$SOCKET_DIR/hermes-op.sock"
SESSION="op-auth-$(date +%Y%m%d-%H%M%S)"

tmux -S "$SOCKET" new -d -s "$SESSION" -n shell

# Sign in (approve in desktop app when prompted)
tmux -S "$SOCKET" send-keys -t "$SESSION":0.0 -- "eval \"\$(op signin --account my.1password.com)\"" Enter

# Verify auth
tmux -S "$SOCKET" send-keys -t "$SESSION":0.0 -- "op whoami" Enter

# Example read
tmux -S "$SOCKET" send-keys -t "$SESSION":0.0 -- "op read 'op://Private/Npmjs/one-time password?attribute=otp'" Enter

# Capture output when needed
tmux -S "$SOCKET" capture-pane -p -J -t "$SESSION":0.0 -S -200

# Cleanup
tmux -S "$SOCKET" kill-session -t "$SESSION"

Common Operations

Explains the idea itself. Read it slowly; the later sections build on it.

Read a secret

Shell1 line
op read "op://app-prod/db/password"

Get OTP

Shell1 line
op read "op://app-prod/npm/one-time password?attribute=otp"

Inject into template

Shell1 line
echo "db_password: {{ op://app-prod/db/password }}" | op inject

Run a command with secret env var

Shell2 lines
export DB_PASSWORD="op://app-prod/db/password"
op run -- sh -c '[ -n "$DB_PASSWORD" ] && echo "DB_PASSWORD is set" || echo "DB_PASSWORD missing"'

Guardrails

Explains the idea itself. Read it slowly; the later sections build on it.

  • Never print raw secrets back to user unless they explicitly request the value.
  • Prefer op run / op inject instead of writing secrets into files.
  • If command fails with "account is not signed in", run op signin again in the same tmux session.
  • If desktop app integration is unavailable (headless/CI), use service account token flow.

CI / Headless note

Explains the idea itself. Read it slowly; the later sections build on it.

For non-interactive use, authenticate with OP_SERVICE_ACCOUNT_TOKEN and avoid interactive op signin. Service accounts require CLI v2.18.0+.

References

Explains the idea itself. Read it slowly; the later sections build on it.

  • references/get-started.md
  • references/cli-examples.md
  • https://developer.1password.com/docs/cli/
  • https://developer.1password.com/docs/service-accounts/