1Password CLI (Hardened)

Secure secret access via 1Password CLI (op) for OpenClaw agents. Service accounts are the canonical approach.

References

• references/get-started.md — install + baseline setup
• references/cli-examples.md — safe command patterns
• references/troubleshooting.md — failure/recovery runbook

Security Rules (must follow)

1. Prefer op run over all alternatives for secret injection.
2. Never enable shell tracing around secret commands (set -x, bash -x).
3. Never print secrets to stdout/logs (echo, cat on secret values/files). printf piped directly to stdin of another command (e.g., printf ... | curl -H @-) is acceptable when the output never reaches a log or terminal.
4. Never dump environment inside/after secret-bearing runs (env, printenv, set).
5. Never pass secrets as CLI args (arguments can appear in process lists).
6. Never pipe secret output to logs/files (tee, >, >>) unless explicitly writing a protected temporary file for op inject.
7. Never pipe op read output into logging pipelines.
8. Use op inject only with locked-down temp files: umask 077, chmod 600, trap cleanup.
9. Never include secret values in chat, tool output, or agent responses. If a command outputs a secret, do not echo or reference its value.

Banned Flags/Patterns

• --no-masking — never use in agent workflows. Masking redacts accidental secret output and must stay on.
• --reveal — never use in routine workflows. Outputs field values in cleartext.
• op signin --raw — outputs raw session token to stdout.
• Bare op read — never run without capturing into a variable. It prints secrets to stdout.
• set -x — never enable around any op command.
• curl -v — verbose mode logs auth headers. Use curl -sSf instead.
• script / terminal recorders — session recording captures all secret output.

Untrusted Input

• Never interpolate user-provided or external text into shell commands without strict quoting.
• Always use -- to separate op flags from command arguments.
• Vault/item/field names from untrusted sources must be validated (alphanumeric, hyphens, underscores, and spaces only).
• Never use eval, backtick substitution, or string-built shell commands with secret references.
• If an item name looks suspicious (contains $, backticks, semicolons, or pipes), stop and verify with the user.

Safe dynamic input template:

VAULT="my-vault"
ITEM="my-item"

# Validate: reject names with dangerous characters
for NAME in "$VAULT" "$ITEM"; do
  if ! LC_ALL=C [[ "$NAME" =~ ^[a-zA-Z0-9\ _-]+$ ]]; then
    echo "ERROR: invalid vault/item name: $NAME" >&2; exit 1
  fi
done

VALUE="$(op read "op://${VAULT}/${ITEM}/password")"
# use $VALUE, then:
unset VALUE