1password Skill

1password -- Claude Code skill

Stop hardcoding API keys in `.env` files where your AI coding tools can read them.

This skill uses 1Password CLI to inject secrets at runtime. Your `.env` holds pointers instead of values, commands run through `op run`, and real secrets never touch disk, terminal output, or your AI's chat window.

Works with Claude Code, Cursor, Windsurf, Antigravity, or any tool that runs shell commands.

---

The idea

Your `.env` becomes pointers, not secrets:

OPENAI_API_KEY=op://Automation/OpenAI/credential

You run things through `op run`:

op run --env-file ~/.env -- python3 script.py

`op run` resolves the pointers, injects real values into the subprocess, and conceals them in any output. If the AI reads your `.env`, it only sees `op://` pointers. If a subprocess prints a secret, 1Password replaces it with ``.

---

How to install

**Easy way:** Drop this whole folder into your project and ask Claude to set it up. Tell Claude to walk you through `reference/setup-guide.md` step by step. It will ask which auth tier you want (biometric, service account manual, or service account auto-loaded) and handle the configuration.

**Manual way:**

1. Follow reference/setup-guide.md once (10-15 minutes)
2. Copy SKILL.md into your Claude Code skills directory:

   mkdir -p ~/.claude/skills/1password
   cp SKILL.md ~/.claude/skills/1password/SKILL.md

3. Restart Claude Code so the skill loads
4. Type /1password whenever you need to add a new API key

---

What's in this folder

File	Purpose
SKILL.md	The /1password skill. Handles the day-to-day of adding new credentials.
reference/setup-guide.md	One-time setup. Install the CLI, pick an auth tier, configure your shell.

---

Critical rules (baked into the skill)

• Never use op read -- it prints raw secret values to the terminal
• **Never paste secrets into