one-password

REQUIRED before ANY `op` command or whenever a task needs an API key, token, password, credential, or secret (OPENAI_API_KEY, ANTHROPIC_API_KEY, deploy tokens, live-test keys). Prompt-free 1Password service-account reads; wrong invocations spam macOS dialogs.

Quality

92%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

85%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, well-structured operational skill with executable scripts, a clear numbered workflow, validation checkpoints, and one-level-deep references to real bundle files. Its only weakness is conciseness: the override-flag shape and single-window rules are repeated, and some rationale prose could be trimmed.

Suggestions

Consolidate the repeated 'OP_LOAD_DESKTOP_APP_SETTINGS=false OP_BIOMETRIC_UNLOCK_ENABLED=false' command shape into one canonical block and reference it, rather than restating the full flag set in every example and prose paragraph.

Move the TCC/PID-scoped macOS App Data rationale (lines 108-116) into references/get-started.md, keeping only the actionable rule inline in the Guardrails, to reduce inline length.

Dedupe the 'never open a second window or session; reuse $WIN' guidance into a single stated rule instead of repeating it across the Workflow, tmux session, and guardrail sections.

Dimension	Reasoning	Score
Conciseness	Most content is genuinely non-obvious operational knowledge Claude would not know (env var overrides, TCC/PID-scoped behavior, socket conventions), but the required override flags and the 'never open a second window' rule are restated several times and some rationale prose could be tightened.	2 / 3
Actionability	Provides multiple complete, copy-paste bash scripts (bootstrap, secret-write, field-read, item-search, debug) with `set -euo pipefail`, exact command shapes, and a table of exact item titles/fields — fully executable and copy-paste ready.	3 / 3
Workflow Clarity	A numbered Workflow with strict-order access paths, explicit validation checkpoints (the `op whoami` rc token check, shape-only field verification), and feedback loops for retry/recovery on a batch/secret operation, matching the 'clear sequence with explicit validation steps' anchor.	3 / 3
Progressive Disclosure	SKILL.md is an overview that signals two real one-level-deep references (references/get-started.md, references/cli-examples.md, both present) in a References section with descriptions, keeping detailed install and example content appropriately split.	3 / 3
	Total	11 / 12 Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that clearly states both what the skill does (prompt-free 1Password service-account reads) and when to use it (before any `op` command or when any credential is needed), with concrete trigger terms and a distinct niche. It is written in third person with no voice issues.

Dimension	Reasoning	Score
Specificity	Names concrete actions and tooling ('Prompt-free 1Password service-account reads', the `op` command) alongside specific credential types and env var examples (OPENAI_API_KEY, ANTHROPIC_API_KEY), matching the 'lists multiple specific concrete actions' anchor.	3 / 3
Completeness	The 'REQUIRED before ANY `op` command or whenever a task needs...secret' clause functions as explicit 'Use when' trigger guidance, and 'Prompt-free 1Password service-account reads' states what it does, so both what and when are explicit.	3 / 3
Trigger Term Quality	Covers natural trigger terms a user would actually say — 'API key', 'token', 'password', 'credential', 'secret', plus concrete deploy tokens and live-test keys — giving good coverage of natural language variations.	3 / 3
Distinctiveness Conflict Risk	The `op` / 1Password service-account niche with concrete env var names and the macOS-dialog failure mode is a clear, distinct niche unlikely to trigger for the wrong skill.	3 / 3
	Total	12 / 12 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning
metadata_field	'metadata' should map string keys to string values	Warning

	Total	14 / 16 Passed

Repository: steipete/agent-scripts
Path: skills/one-password/SKILL.md
Commit: bb36883

Reviewed: about 14 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.