one-password

REQUIRED before ANY `op` command or whenever a task needs an API key, token, password, credential, or secret (OPENAI_API_KEY, ANTHROPIC_API_KEY, deploy tokens, live-test keys). Prompt-free 1Password service-account reads; wrong invocations spam macOS dialogs.

Quality

84%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

77%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, well-structured operational skill with executable scripts, a clear access-path decision tree, and real bundle references. Its main weakness is conciseness: dated proof logs, repeated TCC/install exposition, and inlined scripts/table content add tokens beyond what the core guidance needs.

Suggestions

Trim dated exposition and proof logs (e.g., 'Live proof on 2026-07-16', the long TCC-identity install paragraph) into a short rationale plus a pointer, keeping only the verified fact and the required command shape.

Consolidate the repeated OP_LOAD_DESKTOP_APP_SETTINGS / OP_BIOMETRIC_UNLOCK_ENABLED override rules into one canonical statement and reference it, instead of restating the pair in the workflow, scripts, and guardrails.

Consider moving the large known-Molty-items table and the long reference/debug scripts into a reference file (e.g. references/known-items.md) and keeping only the lookup command and one canonical script inline.

Dimension	Reasoning	Score
Conciseness	The body is dense and information-rich but frequently over-explains environment-specific history (e.g., the long install/TCC identity paragraph, dated proof logs like "Live proof on 2026-07-16", and repeated restatements of the same override rules), which adds tokens Claude could mostly be trusted to retain once stated.	3 / 5
Actionability	It provides multiple complete, copy-paste-ready bash scripts (op-store-secret.sh, op-read-field.sh, op-find-item.sh, op-debug.sh) plus exact command shapes with required env vars, vault scoping, and verified failure cases — fully executable guidance covering the common operations.	5 / 5
Workflow Clarity	There is a clear numbered Workflow with sequenced steps and explicit validation (the `op whoami` rc check, shape-only field verification, "STOP and ask" checkpoints), but destructive/batch secret operations rely on conventions rather than a strict validate-then-proceed feedback loop, and the cap-related feedback-loop guidance is only partly explicit.	4 / 5
Progressive Disclosure	The SKILL.md is a well-sectioned overview that pushes install/get-started and CLI examples into real one-level-deep reference files (references/get-started.md, references/cli-examples.md) with clear inline pointers, though the body still inlines a large known-items table and several full scripts that could arguably live in references.	4 / 5
	Total	16 / 20 Passed

Description

91%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, trigger-rich description that explicitly covers what and when with concrete env-var examples and a strong activation hook. Minor room to widen the action vocabulary beyond "reads" and tighten distinctiveness against generic secret skills.

Dimension	Reasoning	Score
Specificity	The description lists concrete actions ("prompt-free 1Password service-account reads", "wrong invocations spam macOS dialogs") and a clear domain (credentials/secrets), but the action list leans on a single core verb (reads) rather than enumerating multiple distinct operations like create/edit/search.	4 / 5
Completeness	It answers both halves explicitly: the "what" (prompt-free 1Password service-account reads) and the "when" (REQUIRED before ANY `op` command or whenever a task needs an API key/token/password/credential/secret), with concrete trigger phrases.	5 / 5
Trigger Term Quality	It covers natural user-facing terms and concrete identifiers — "API key, token, password, credential, or secret" plus specific env var names (OPENAI_API_KEY, ANTHROPIC_API_KEY, deploy tokens, live-test keys) and the trigger phrase "REQUIRED before ANY `op` command", giving comprehensive coverage including synonyms and exact strings.	5 / 5
Distinctiveness Conflict Risk	The trigger is a clear niche (1Password `op` CLI, macOS dialog spam) unlikely to fire for unrelated skills, but the broad credential/secret wording could create minor overlap with other secret-handling skills.	4 / 5
	Total	18 / 20 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning
metadata_field	'metadata' should map string keys to string values	Warning

	Total	14 / 16 Passed

Repository: steipete/agent-scripts
Path: skills/one-password/SKILL.md
Commit: dc4f583

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.