1password

使用方法

复制安装命令，在自己的智能体环境安装前先检查源码包。
从原始文档核对所需工具、凭据和支持的宿主。
说明输入材料与期望交付物，并对照来源检查输出。

npx skills add https://github.com/nousresearch/hermes-agent --skill 1password

开始前需了解

安装不包含模型订阅、API 额度或访问文件的权限。
仓库星数和安装量反映活跃情况，不等于独立质量或安全测试。

仓库原始内容

按源仓库内容呈现，保留标题、案例、代码、表格、链接以及原文引用的演示图片。

1Password CLI

Use this skill when the user wants secrets managed through 1Password instead of plaintext env vars or files.

Requirements

1Password account
1Password CLI (op) installed
One of: desktop app integration, service account token (OP_SERVICE_ACCOUNT_TOKEN), or Connect server
tmux available for stable authenticated sessions during Hermes terminal calls (desktop app flow only)

When to Use

Install or configure 1Password CLI
Sign in with op signin
Read secret references like op://Vault/Item/field
Inject secrets into config/templates using op inject
Run commands with secret env vars via op run

Authentication Methods

Service Account (recommended for Hermes)

Set OP_SERVICE_ACCOUNT_TOKEN in ${HERMES_HOME:-~/.hermes}/.env (the skill will prompt for this on first load). No desktop app needed. Supports op read, op inject, op run.

bash

export OP_SERVICE_ACCOUNT_TOKEN="your-token-here"
op whoami  # verify — should show Type: SERVICE_ACCOUNT

Desktop App Integration (interactive)

Enable in 1Password desktop app: Settings → Developer → Integrate with 1Password CLI
Ensure app is unlocked
Run op signin and approve the biometric prompt

Connect Server (self-hosted)

bash

export OP_CONNECT_HOST="http://localhost:8080"
export OP_CONNECT_TOKEN="your-connect-token"

Setup

Install CLI:

bash

# macOS
brew install 1password-cli

# Linux (official package/install docs)
# See references/get-started.md for distro-specific links.

# Windows (winget)
winget install AgileBits.1Password.CLI

Verify:

bash

op --version

Choose an auth method above and configure it.

Hermes Execution Pattern (desktop app flow)

Hermes terminal commands are non-interactive by default and can lose auth context between calls. For reliable op use with desktop app integration, run sign-in and secret operations inside a dedicated tmux session.

Note: This is NOT needed when using OP_SERVICE_ACCOUNT_TOKEN — the token persists across terminal calls automatically.

bash

SOCKET_DIR="${TMPDIR:-${HERMES_HOME:-$HOME/.hermes}/cache/scratch}/hermes-tmux-sockets"
mkdir -p "$SOCKET_DIR"
SOCKET="$SOCKET_DIR/hermes-op.sock"
SESSION="op-auth-$(date +%Y%m%d-%H%M%S)"

tmux -S "$SOCKET" new -d -s "$SESSION" -n shell

# Sign in (approve in desktop app when prompted)
tmux -S "$SOCKET" send-keys -t "$SESSION":0.0 -- "eval \"\$(op signin --account my.1password.com)\"" Enter

# Verify auth
tmux -S "$SOCKET" send-keys -t "$SESSION":0.0 -- "op whoami" Enter

# Example read
tmux -S "$SOCKET" send-keys -t "$SESSION":0.0 -- "op read 'op://Private/Npmjs/one-time password?attribute=otp'" Enter

# Capture output when needed
tmux -S "$SOCKET" capture-pane -p -J -t "$SESSION":0.0 -S -200

# Cleanup
tmux -S "$SOCKET" kill-session -t "$SESSION"

Common Operations

Read a secret

bash

op read "op://app-prod/db/password"

Get OTP

bash

op read "op://app-prod/npm/one-time password?attribute=otp"

Inject into template

bash

echo "db_password: {{ op://app-prod/db/password }}" | op inject

Run a command with secret env var

bash

export DB_PASSWORD="op://app-prod/db/password"  # example op:// reference, resolved by `op run`
op run -- sh -c '[ -n "$DB_PASSWORD" ] && echo "DB_PASSWORD is set" || echo "DB_PASSWORD missing"'

Guardrails

Never print raw secrets back to user unless they explicitly request the value.
Prefer op run / op inject instead of writing secrets into files.
If command fails with "account is not signed in", run op signin again in the same tmux session.
If desktop app integration is unavailable (headless/CI), use service account token flow.