npx skills add https://github.com/0xbigboss/claude-code --skill op-cliop) — 安全处理指南绝对不要使用会向对话中打印密钥值的 op 命令。应始终直接通过管道传递给使用工具,或使用 wc -c / 脱敏方式来验证而不暴露密钥。
# 错误 — 会将密钥打印到 stdout(请勿运行)
# op item get ITEM_ID --vault VAULT --fields label=PASSWORD --reveal
# 正确 — 直接通过管道传递给使用工具
op item get ITEM_ID --vault VAULT --fields label=PASSWORD --reveal | \
wrangler secret put SECRET_NAME --env ENV
# 正确 — 验证值是否存在而不暴露它
op item get ITEM_ID --vault VAULT --fields label=PASSWORD --reveal 2>/dev/null | wc -c
许多 1Password 条目使用路径式标题(例如 pool-party/testnet-pool-party-public/credentials)。op:// URI 格式无法处理这类标题,因为它使用 / 作为分隔符。
op) — Secure HandlingNEVER use op commands that would print secret values into the conversation. Always pipe directly to the consuming tool or use wc -c / redaction to verify without exposing.
# WRONG — would print secret to stdout (do not run)
# op item get ITEM_ID --vault VAULT --fields label=PASSWORD --reveal
# RIGHT — pipe directly to consumer
op item get ITEM_ID --vault VAULT --fields label=PASSWORD --reveal | \
wrangler secret put SECRET_NAME --env ENV
# RIGHT — verify a value exists without exposing it
op item get ITEM_ID --vault VAULT --fields label=PASSWORD --reveal 2>/dev/null | wc -c
Many 1Password items use path-style titles (e.g. pool-party/testnet-pool-party-public/credentials). The op:// URI format with these because it uses as a delimiter.
广告位招租
在这里展示您的产品或服务
触达数万 AI 开发者,精准高效
# 无效 — '/' 分段过多
op read "op://pool-party-testnet/pool-party/testnet-pool-party-public/credentials/PASSWORD"
# 错误:'/' 过多:密钥引用应匹配 op://<vault>/<item>[/<section>]/<field>
# 有效 — 改用条目 ID(避免打印值)
op item get ITEM_ID --vault VAULT --fields label=FIELD --reveal 2>/dev/null | wc -c
当您不知道条目 ID 时:
# 1. 列出保险库中的条目以查找标题和 ID
op item list --vault VAULT_NAME
# 2. 使用 ID(第一列)进行所有后续读取操作
op item get ITEM_ID --vault VAULT_NAME --fields label=FIELD_NAME --reveal 2>/dev/null | wc -c
# 验证存在哪些字段(安全 — 仅显示标签而非值)
op item get ITEM_ID --vault VAULT_NAME --format json 2>/dev/null | \
python3 -c "import json,sys; [print(f['label']) for s in json.load(sys.stdin).get('fields',[]) for f in [s] if f.get('label')]"
# 将每个字段通过管道传递给其目标
op item get ITEM_ID --vault VAULT --fields label=USERNAME --reveal | consumer_cmd ...
op item get ITEM_ID --vault VAULT --fields label=PASSWORD --reveal | consumer_cmd ...
op item get ITEM_ID --vault VAULT --fields label=PASSWORD --reveal | \
npx wrangler secret put POOL_PARTY_PUBLIC_PASSWORD --env testnet
SECRET="$(op item get ITEM_ID --vault VAULT --fields label=TOKEN --reveal 2>/dev/null)"
# 在同一 shell 的后续命令中使用 $SECRET — 它不会出现在输出中
op item get ITEM_ID --vault VAULT --fields label=PASSWORD --reveal | \
kubectl create secret generic my-secret --from-file=password=/dev/stdin
# 检查值是否非空(字符计数)
op item get ITEM_ID --vault VAULT --fields label=PASSWORD --reveal 2>/dev/null | wc -c
# 比较两个源是否匹配(仅退出码)
if cmp -s <(op item get ID1 --vault V --fields label=F --reveal 2>/dev/null) \
<(op item get ID2 --vault V --fields label=F --reveal 2>/dev/null); then
echo "匹配"
else
echo "不同"
fi
| 错误 | 原因 | 解决方法 |
|---|---|---|
too many '/' | 条目标题包含斜杠,op:// 无法解析 | 使用 op item get 配合条目 ID |
could not find item | 错误的保险库或标题不匹配 | 运行 op item list --vault VAULT 来查找 |
| 空输出 | 缺少 --reveal 标志 | 添加 --reveal 并通过管道传递给使用工具(或 ` |
not signed in | 会话已过期 | 运行 eval "$(op signin)"(避免打印会话令牌) |
每周安装量
46
代码仓库
GitHub 星标数
36
首次出现
2026年2月13日
安全审计
安装于
codex39
claude-code37
opencode36
gemini-cli36
github-copilot36
cursor36
/# BROKEN — too many '/' segments
op read "op://pool-party-testnet/pool-party/testnet-pool-party-public/credentials/PASSWORD"
# ERROR: too many '/': secret references should match op://<vault>/<item>[/<section>]/<field>
# WORKS — use item ID instead (avoid printing values)
op item get ITEM_ID --vault VAULT --fields label=FIELD --reveal 2>/dev/null | wc -c
When you don't know the item ID:
# 1. List items in a vault to find the title and ID
op item list --vault VAULT_NAME
# 2. Use the ID (first column) for all subsequent reads
op item get ITEM_ID --vault VAULT_NAME --fields label=FIELD_NAME --reveal 2>/dev/null | wc -c
# Verify which fields exist (safe — shows labels not values)
op item get ITEM_ID --vault VAULT_NAME --format json 2>/dev/null | \
python3 -c "import json,sys; [print(f['label']) for s in json.load(sys.stdin).get('fields',[]) for f in [s] if f.get('label')]"
# Pipe each field to its destination
op item get ITEM_ID --vault VAULT --fields label=USERNAME --reveal | consumer_cmd ...
op item get ITEM_ID --vault VAULT --fields label=PASSWORD --reveal | consumer_cmd ...
op item get ITEM_ID --vault VAULT --fields label=PASSWORD --reveal | \
npx wrangler secret put POOL_PARTY_PUBLIC_PASSWORD --env testnet
SECRET="$(op item get ITEM_ID --vault VAULT --fields label=TOKEN --reveal 2>/dev/null)"
# Use $SECRET in subsequent commands within the same shell — it won't appear in output
op item get ITEM_ID --vault VAULT --fields label=PASSWORD --reveal | \
kubectl create secret generic my-secret --from-file=password=/dev/stdin
# Check a value is non-empty (char count)
op item get ITEM_ID --vault VAULT --fields label=PASSWORD --reveal 2>/dev/null | wc -c
# Compare two sources match (exit code only)
if cmp -s <(op item get ID1 --vault V --fields label=F --reveal 2>/dev/null) \
<(op item get ID2 --vault V --fields label=F --reveal 2>/dev/null); then
echo "match"
else
echo "differ"
fi
| Error | Cause | Fix |
|---|---|---|
too many '/' | Item title has slashes, op:// can't parse it | Use item ID with op item get |
could not find item | Wrong vault or title mismatch | Run op item list --vault VAULT to discover |
| Empty output | Missing --reveal flag | Add --reveal and pipe to consumer (or ` |
not signed in | Session expired | Run eval "$(op signin)" (avoid printing the session token) |
Weekly Installs
46
Repository
GitHub Stars
36
First Seen
Feb 13, 2026
Security Audits
Installed on
codex39
claude-code37
opencode36
gemini-cli36
github-copilot36
cursor36
AI新闻播客制作技能:实时新闻转对话式播客脚本与音频生成
1,200 周安装