Agent Economy ReportAgent Economy ReportCAUTION version 1.0.1 · audited 2026-09-17
This package teaches an AI agent how to install and use the official 1Password command-line tool. It directs the agent to sign in to 1Password and run secret-related commands inside a temporary tmux session so the session can be reused. No hidden code, obfuscation, or unexpected network destination was found. The package does require shell access and 1Password account access, which is expected for its purpose. A few included examples are risky because they show writing a private key to disk and printing a password with masking disabled; those conflict with the package's own guardrails.
| Declared purpose | Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in (single or multi-account), or reading/injecting/running secrets via op. |
| Observed behavior | The package consists of markdown instructions and examples. It tells the agent to verify op is installed, create a fresh tmux socket/session, run op signin and op whoami, then use op for vault list and secret read/run/inject operations. It includes guardrails against printing secrets and writing them to disk, but also includes examples that write a key to disk and run op with --no-masking. |
| Verdict, rules only | SAFE |
| Verdict, AI | CAUTION |
| Final verdict | CAUTION (never better than either pass) |
| capability | vs purpose | detail |
|---|---|---|
| shell | needed | The skill instructs the agent to run bash/tmux commands such as op signin, op whoami, and op vault list (SKILL.md lines 33-44). |
| credentials | needed | It requires 1Password sign-in and can access stored secrets through op read, op run, and op inject (SKILL.md lines 40-42; references/cli-examples.md lines 10-24). |
| filesystem_read | needed | op read reads secret items from 1Password vaults (references/cli-examples.md lines 10-12). |
| filesystem_write | needed | Examples allow writing files such as ./key.pem or config.yml through op read --out-file and op inject -o (references/cli-examples.md lines 13 and 24). |
| install_packages | needed | Metadata declares a brew install formula for the 1Password CLI (SKILL.md line 5). |
| severity | finding |
|---|---|
| info | Declared purpose includes secret access This matches the credential-handling behavior found in the rest of the package. SKILL.md:3 description: Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in (single or multi-account), or reading/ |
| info | Requires tmux for all op commands The skill requires shell and tmux access to maintain the 1Password session. This is stated openly but should be reviewed because it gives the agent command execution on the host. SKILL.md:22 4. REQUIRED: create a fresh tmux session for all `op` commands (no direct `op` calls outside tmux). |
| info | Signs in to 1Password The example starts an op signin command for account my.1password.com inside tmux. This is the intended authentication step. SKILL.md:40 tmux -S "$SOCKET" send-keys -t "$SESSION":0.0 -- "op signin --account my.1password.com" Enter |
| low | Captures tmux pane output The example captures the previous 200 lines of the tmux pane. If any command printed a secret, the captured output would contain it. SKILL.md:43 tmux -S "$SOCKET" capture-pane -p -J -t "$SESSION":0.0 -S -200 |
| info | Guardrail against secret exposure The skill includes a warning against pasting secrets, but the warning is only instructional. SKILL.md:49 - Never paste secrets into logs, chat, or code. |
| medium | Example writes a private key to disk This example writes a decrypted SSH private key to ./key.pem. It conflicts with the skill's own guardrail preferring op run/op inject over writing secrets to disk (SKILL.md line 50). references/cli-examples.md:13 - `op read --out-file ./key.pem op://app-prod/server/ssh/key.pem` |
| low | Example exports a secret reference literally Outside op run, this line would set DB_PASSWORD to the literal text op://app-prod/db/password rather than the actual secret. It may confuse an agent reading the examples. references/cli-examples.md:17 - `export DB_PASSWORD="op://app-prod/db/password"` |
| medium | Example disables secret masking and prints a password This example runs op with masking disabled and prints DB_PASSWORD, which can expose a plaintext secret to terminal output, logs, or captured tmux panes. This conflicts with SKILL.md line 49. references/cli-examples.md:18 - `op run --no-masking -- printenv DB_PASSWORD` |
| low | Injection can write resolved files The documented op inject example creates config.yml. If the template contains secret references, the output file may contain resolved secrets. references/cli-examples.md:24 - `op inject -i config.yml.tpl -o config.yml` |
| info | Assumes 1Password subscription and desktop app The skill is not standalone; it depends on an existing 1Password subscription and app integration for the sign-in flow. references/get-started.md:6 - Requires a 1Password subscription and the desktop app to use app integration. |
0 AI finding(s) were dropped because their file, line or quote did not match the package.
| domain | service rating | where |
|---|---|---|
| clawhub.ai | not in the service index | skill-card.md:9 |
| developer.1password.com | not in the service index | SKILL.md:4 |
| Binaries invoked | bash, sh, zsh |
| Environment variables read | CLAWDBOT_TMUX_SOCKET_DIR, SESSION, SOCKET, SOCKET_DIR, TMPDIR |
| Hard-coded wallets | none |
| Pipes a download to a shell | 0 |
| eval / exec / subprocess | 0 |
| base64 blobs | 0 |
| File writes | 0 |
| Persistence | 0 |
| file | lines | sha256 |
|---|---|---|
SKILL.md | 53 | 5cc0b694c2c26264… |
_meta.json | 6 | b0335ac67b848f2a… |
references/cli-examples.md | 29 | 7df8fb39623b7cd2… |
references/get-started.md | 17 | e5fc5c4fbfd61fa5… |
skill-card.md | 59 | 51d8bc7258b7e6a0… |
For agents
JSON: https://agenteconomy.report/k/1password.audit.json · badge: https://agenteconomy.report/k/1password.audited.svg ·
skill rating: /k/1password · commission an audit of any skill: US$ 29 per version.
The complete published package of this exact version was downloaded from the registry and read statically; nothing was executed. A deterministic pass extracts network destinations, binaries, environment variables, writes, install commands, obfuscation markers, subprocesses and wallets, each with file and line. An AI then reads the whole package with those facts and writes the summary, the capabilities and the findings under a strict schema; every finding it produces must cite a file, a line and the exact text, or it is dropped. The final verdict is the worst of the two passes. The audit does not change the skill's trust tier (policy); the author may respond through the dispute channel and the response is published here. Commissioned by: the Agent Economy Report (free program: the 150 most downloaded skills, September 2026).