Vault Secret Ops

The problem

Managing credentials manually leads to secrets leaking into shell history, logs, and plain-text configuration files. Engineering teams often struggle to programmatically access shared vaults without compromising security during local development or CI/CD pipelines.

What it does

• Authenticates and manages session tokens for the 1Password CLI v2.
• Retrieves, creates, and edits vault items including passwords, notes, and metadata.
• Injects secrets directly into environment variables or commands using op:// references to avoid disk persistence.
• Generates TOTP codes and handles SSH private key exports for automated infrastructure access.
• Performs access audits to list vault members and user permissions.

Frameworks & tools

1Password CLI (v2.x), 1Password Events API, and standard shell environments.

Why this beats prompting it yourself

Writing manual wrappers for secret management often leads to insecure practices like echoing variables to stdout. This skill enforces the use of 1Password references and secure session handling, ensuring secrets are only resolved in-memory during execution rather than appearing in logs or command history.

Use cases

• Provisioning service account credentials for automated deployment scripts.
• Injecting production secrets into local environment files for debugging.
• Automating 2FA login flows by programmatically generating OTP codes.
• Managing and rotating SSH keys for cloud server access.

Known limitations

Requires 1Password CLI v2.x to be pre-installed on the host system. It cannot rotate credentials for services not managed by 1Password or recover forgotten master passwords.