[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71R31Y9XQ34Y1M5MVA46MNH":3,"skill-same:01M71R31Y9XQ34Y1M5MVA46MNH":81},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":59,"commitSha":60,"skillDirectory":61,"forksCount":14,"repositoryHtmlUrl":62,"repositoryHomepageUrl":6,"ownerHtmlUrl":63,"ownerBlogUrl":64,"ownerDescription":65,"updatedAt":66,"install":67,"resources":80},"01M71R31Y9XQ34Y1M5MVA46MNH","onepassword-agent-secret-flows",null,"Use 1Password safely in Hermes\u002Fagent workflows: migrate written API keys, inject secrets with op run, triage vault inventories for agent-safe automation, avoid transcript leaks, and handle OAuth\u002Fpassword-gated flows.","GregM1991\u002Fskills","GregM1991","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F55473436?v=4","01M71R22C33EXMAMFV3C9SVS20","Greg Martin","01M71R22CSG8T5ZWDASF0E3HH4",0,"MIT","https:\u002F\u002Fgithub.com\u002FGregM1991\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fonepassword-agent-secret-flows\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"onepassword agent secret flows","secret","flows","onepassword","password","handle","api keys","for","with","use","1password","migrate","api","credentials","vault","OAuth","transcript","run","workflows","automation","2026-11-10 13:02:02",false,"---\nname: onepassword-agent-secret-flows\ndescription: \"Use 1Password safely in Hermes\u002Fagent workflows: migrate written API keys, inject secrets with op run, triage vault inventories for agent-safe automation, avoid transcript leaks, and handle OAuth\u002Fpassword-gated flows.\"\nversion: 1.1.0\nauthor: Hermes Agent\nlicense: MIT\nmetadata:\n  hermes:\n    tags: [1password, secrets, op, security, agents, oauth, credentials]\n---\n\n# 1Password Agent Secret Flows\n\nUse this skill when the user wants to migrate API keys\u002Fpasswords into 1Password, make secrets available to Hermes profiles\u002Fagents, review which secrets are safe for automation, produce 1Password inventory triage worksheets, or debug auth flows without leaking secrets into transcripts.\n\nCore rule: **1Password is a secret injection layer, not a database for the model to read.** Agents should run commands that consume secrets, not commands that print secrets.\n\n## Secret inventory triage for agent-safe automation\n\nUse this section when Greg wants to review a large 1Password vault, decide which secrets are safe for agent automation, identify stale keys, or produce a human-reviewable migration\u002Fdeletion worksheet.\n\nCore rule: **triage from metadata first; never inspect or print secret values unless the user explicitly asks and the action is safe.** The goal is to make Greg review a compact, pre-shaped decision file, not hundreds of raw items.\n\n### Metadata-first workflow\n\n1. Gather item metadata only. Example:\n\n   ```bash\n   mkdir -p \u002Fhome\u002Fgm\u002F.agents\u002Fonepassword-inventory\n   op item list --vault Personal --long --include-archive --format json > \u002Fhome\u002Fgm\u002F.agents\u002Fonepassword-inventory\u002Fpersonal-items-long.json\n   ```\n\n2. Build a compact markdown triage worksheet grouped by likely decision class. Do **not** give Greg a flat all-items checklist. Prefill suggested one-letter marks so he can skim and correct.\n3. Use metadata signals only unless explicitly asked otherwise: `category`, `createdAt`, `updatedAt`, archive state, duplicate titles, tags, and title keywords such as `api`, `token`, `secret`, `bot`, `old`, `uat`, `sandbox`, `recovery`, `bank`, `card`.\n4. Be explicit that 1Password CLI metadata is not a reliable “last used” source for arbitrary items. Treat `updatedAt` as “last edited”, not “last successfully used by a service”.\n5. For delete decisions, prefer a safety ladder: `A` archive after quick verification; `D` delete only after confirming revoked\u002Fdead\u002Fduplicate; `R` rotate first for API keys, then store a new scoped credential in `Agents` and revoke the old Personal-vault secret.\n\n### Worksheet groups and marks\n\nRecommended groups:\n\n- **A. Keep personal \u002F exclude from Agents** — banking, identity, recovery codes, cards, personal logins, broad admin\u002Froot credentials.\n- **B. Likely copy\u002Frotate into Agents** — scoped API keys, bot tokens, service credentials needed by automation.\n- **C. Automation-ish but high-risk\u002Fadmin** — Cloudflare, GitHub broad PATs, restic\u002Fbackup passwords, homelab\u002Fadmin credentials; require careful scoping or rotation.\n- **D. Duplicates or ambiguous names** — duplicate titles, generic `Login`, generic `Secure Note`, old SSH keys, unclear purpose.\n- **E. Possibly stale** — old\u002Ftest\u002FUAT\u002Fsandbox\u002Fdeprecated names or very old `updatedAt`.\n- **F. Low-priority \u002F probably leave alone** — ordinary personal logins with no agent use and no stale\u002Fdelete signal.\n\nMark codes: `K` keep personal; `C` copy safe automation fields; `M` move eventually; `R` rotate first; `A` archive after verification; `D` delete only after confirming revoked\u002Fdead\u002Fduplicate; `N` rename\u002Fmerge metadata; `?` investigate.\n\nInventory triage pitfalls:\n\n- Do not ask Greg to personally classify hundreds of items from scratch; preclassify and let him correct questionable rows.\n- Do not imply `updatedAt` proves a secret is active or inactive.\n- Do not migrate recovery codes, banking credentials, identity documents, personal cards, or broad admin\u002Froot credentials into an agent-readable vault by default.\n- Avoid duplicating long-lived API keys indefinitely. Rotation into a scoped agent-safe key is usually better than copying.\n\n## New session notes to preserve\n\n- During live 1Password web UI setup, give one step at a time and wait for Greg to report the next screen\u002Foptions.\n- Recommended agent vault: `Agents`; description: `Secrets intentionally exposed to automation agents via scoped 1Password service accounts and op run wrappers. Do not store personal passwords, recovery codes, banking credentials, or broad admin\u002Froot credentials here.`\n- Recommended service account permissions: select only `Agents`; disable new vault creation; grant `Read items` only; leave `Write items` and `Share items` off; leave Environment access empty unless deliberately using 1Password Environments.\n- Saving the service account token in Greg's Personal\u002FPrivate vault is sane as an admin\u002Frecovery copy because service accounts cannot access those built-in vaults.\n- Homelab service-account token file pattern: `\u002Fhome\u002Fgm\u002F.agents\u002Fsecrets\u002Fonepassword\u002Fhermes-default-agent.env`, containing `OP_SERVICE_ACCOUNT_TOKEN=...`, file mode `600`, parent dirs `700`.\n- Todoist initial item path: `op:\u002F\u002FAgents\u002Ftodoist-cli-api-key\u002Fapi_token`; verify field presence without printing values via `op item get todoist-cli-api-key --vault Agents --format json | jq '.title, .vault.name, [.fields[].label]'`.\n- If copying existing personal-vault items into `Agents`, trim copies down to automation-safe fields; API-key flows do not need login passwords\u002Frecovery codes unless browser\u002Flogin flows are intentionally required.\n","# 1Password Agent Secret Flows\n\nUse this skill when the user wants to migrate API keys\u002Fpasswords into 1Password, make secrets available to Hermes profiles\u002Fagents, review which secrets are safe for automation, produce 1Password inventory triage worksheets, or debug auth flows without leaking secrets into transcripts.\n\nCore rule: **1Password is a secret injection layer, not a database for the model to read.** Agents should run commands that consume secrets, not commands that print secrets.\n\n## Secret inventory triage for agent-safe automation\n\nUse this section when Greg wants to review a large 1Password vault, decide which secrets are safe for agent automation, identify stale keys, or produce a human-reviewable migration\u002Fdeletion worksheet.\n\nCore rule: **triage from metadata first; never inspect or print secret values unless the user explicitly asks and the action is safe.** The goal is to make Greg review a compact, pre-shaped decision file, not hundreds of raw items.\n\n### Metadata-first workflow\n\n1. Gather item metadata only. Example:\n\n   ```bash\n   mkdir -p \u002Fhome\u002Fgm\u002F.agents\u002Fonepassword-inventory\n   op item list --vault Personal --long --include-archive --format json > \u002Fhome\u002Fgm\u002F.agents\u002Fonepassword-inventory\u002Fpersonal-items-long.json\n   ```\n\n2. Build a compact markdown triage worksheet grouped by likely decision class. Do **not** give Greg a flat all-items checklist. Prefill suggested one-letter marks so he can skim and correct.\n3. Use metadata signals only unless explicitly asked otherwise: `category`, `createdAt`, `updatedAt`, archive state, duplicate titles, tags, and title keywords such as `api`, `token`, `secret`, `bot`, `old`, `uat`, `sandbox`, `recovery`, `bank`, `card`.\n4. Be explicit that 1Password CLI metadata is not a reliable “last used” source for arbitrary items. Treat `updatedAt` as “last edited”, not “last successfully used by a service”.\n5. For delete decisions, prefer a safety ladder: `A` archive after quick verification; `D` delete only after confirming revoked\u002Fdead\u002Fduplicate; `R` rotate first for API keys, then store a new scoped credential in `Agents` and revoke the old Personal-vault secret.\n\n### Worksheet groups and marks\n\nRecommended groups:\n\n- **A. Keep personal \u002F exclude from Agents** — banking, identity, recovery codes, cards, personal logins, broad admin\u002Froot credentials.\n- **B. Likely copy\u002Frotate into Agents** — scoped API keys, bot tokens, service credentials needed by automation.\n- **C. Automation-ish but high-risk\u002Fadmin** — Cloudflare, GitHub broad PATs, restic\u002Fbackup passwords, homelab\u002Fadmin credentials; require careful scoping or rotation.\n- **D. Duplicates or ambiguous names** — duplicate titles, generic `Login`, generic `Secure Note`, old SSH keys, unclear purpose.\n- **E. Possibly stale** — old\u002Ftest\u002FUAT\u002Fsandbox\u002Fdeprecated names or very old `updatedAt`.\n- **F. Low-priority \u002F probably leave alone** — ordinary personal logins with no agent use and no stale\u002Fdelete signal.\n\nMark codes: `K` keep personal; `C` copy safe automation fields; `M` move eventually; `R` rotate first; `A` archive after verification; `D` delete only after confirming revoked\u002Fdead\u002Fduplicate; `N` rename\u002Fmerge metadata; `?` investigate.\n\nInventory triage pitfalls:\n\n- Do not ask Greg to personally classify hundreds of items from scratch; preclassify and let him correct questionable rows.\n- Do not imply `updatedAt` proves a secret is active or inactive.\n- Do not migrate recovery codes, banking credentials, identity documents, personal cards, or broad admin\u002Froot credentials into an agent-readable vault by default.\n- Avoid duplicating long-lived API keys indefinitely. Rotation into a scoped agent-safe key is usually better than copying.\n\n## New session notes to preserve\n\n- During live 1Password web UI setup, give one step at a time and wait for Greg to report the next screen\u002Foptions.\n- Recommended agent vault: `Agents`; description: `Secrets intentionally exposed to automation agents via scoped 1Password service accounts and op run wrappers. Do not store personal passwords, recovery codes, banking credentials, or broad admin\u002Froot credentials here.`\n- Recommended service account permissions: select only `Agents`; disable new vault creation; grant `Read items` only; leave `Write items` and `Share items` off; leave Environment access empty unless deliberately using 1Password Environments.\n- Saving the service account token in Greg's Personal\u002FPrivate vault is sane as an admin\u002Frecovery copy because service accounts cannot access those built-in vaults.\n- Homelab service-account token file pattern: `\u002Fhome\u002Fgm\u002F.agents\u002Fsecrets\u002Fonepassword\u002Fhermes-default-agent.env`, containing `OP_SERVICE_ACCOUNT_TOKEN=...`, file mode `600`, parent dirs `700`.\n- Todoist initial item path: `op:\u002F\u002FAgents\u002Ftodoist-cli-api-key\u002Fapi_token`; verify field presence without printing values via `op item get todoist-cli-api-key --vault Agents --format json | jq '.title, .vault.name, [.fields[].label]'`.\n- If copying existing personal-vault items into `Agents`, trim copies down to automation-safe fields; API-key flows do not need login passwords\u002Frecovery codes unless browser\u002Flogin flows are intentionally required.\n",{"name":5,"author":49,"license":15,"version":50,"metadata":51,"description":7},"Hermes Agent","1.1.0",{"hermes":52},{"tags":53},[34,54,55,56,57,58,37],"secrets","op","security","agents","oauth","main","ea6b43b33da18b9f5a9e431df0d25d369ce3d8c4","skills\u002Fonepassword-agent-secret-flows","https:\u002F\u002Fgithub.com\u002FGregM1991\u002Fskills","https:\u002F\u002Fgithub.com\u002FGregM1991","https:\u002F\u002Fwww.gregmartin.dev\u002F","Full Stack Software Engineer who teeters towards the front end making things all pretty and shiny.","2026-11-14 17:52:00",{"source":8,"skillName":5,"commands":68,"prompt":78,"zipAvailable":79},[69,72,75],{"tool":70,"command":71},"npx","npx skills add GregM1991\u002Fskills --skill onepassword-agent-secret-flows",{"tool":73,"command":74},"bunx","bunx skills add GregM1991\u002Fskills --skill onepassword-agent-secret-flows",{"tool":76,"command":77},"pnpm","pnpm dlx skills add GregM1991\u002Fskills --skill onepassword-agent-secret-flows","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FGregM1991\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fonepassword-agent-secret-flows\u002FSKILL.md",true,[],[]]