sd0xdevsd0xdev/sd0x-dev-flow/skills/op-session/SKILL.md

op-session

Skill192 starsChanged 36 days agoMITView on GitHub

Initialize 1Password CLI session for Claude Code. Use when: starting a session that needs 1Password secrets, op CLI keeps prompting biometric auth, setting up OP_SESSION token. Solves: Claude Code's no-TTY subprocess model triggers 1Password biometric auth on every op call. Supports both token-based and App Integration auth modes — auto-detects which mode to use.

1 other project uses a version of this.

Adopted by

Most recently taken up by

sd0xdev/sd0x-harnessword for word, first seen Oct 6, 2026

Other versions1 project uses a version of this.
Word for word · 1
sd0xdev/sd0x-harness★ 192100% same
Edited · 0
None found.
Wrote their own version · 0
None found.
How matches are found. Word for word: the exact same text. Edited: shares passages with this file (“99% same” means 99% of its five-word phrases also appear here; 10% or more counts). Their own version: similar meaning, or, weakest, the same name. We can’t tell which project had it first. Projects are counted among the 200 most-starred candidates, and mentions are links to the repository we found, up to 50 per site, so both counts are a floor.
In this repository102 other files it gives its agents.
- CLAUDE.mdCLAUDE.md
- adrSkill
- agentctl-setupSkill
- architectureSkill
- askSkill
- best-practicesSkill
- bug-fixSkill
- bump-versionSkill
- check-coverageSkill
- claude-healthSkill
- code-exploreSkill
- code-investigateSkill
- codex-architectSkill
- codex-brainstormSkill
- codex-cli-reviewSkill
- codex-code-reviewSkill
- codex-explainSkill
- codex-implementSkill
- codex-review-branchSkill
- codex-review-docSkill
- codex-review-fastSkill
- codex-reviewSkill
- codex-securitySkill
- codex-setupSkill
- codex-test-genSkill
- codex-test-reviewSkill
- contract-decodeSkill
- create-prSkill
- create-requestSkill
- de-ai-flavorSkill
- debugSkill
- deep-analyzeSkill
- deep-exploreSkill
- deep-researchSkill
- dep-auditSkill
- deploy-flowSkill
- dev-security-auditSkill
- doc-refactorSkill
- doc-reviewSkill
- epic-mergeSkill
- feasibility-studySkill
- feature-devSkill
- feature-verifySkill
- fp-briefSkill
- generate-runnerSkill
- gh-stackSkill
- git-investigateSkill
- git-profileSkill
- install-hooksSkill
- install-rulesSkill
- install-scriptsSkill
- issue-analyzeSkill
- jiraSkill
- load-pr-reviewSkill
- merge-prepSkill
- necessity-auditSkill
- next-stepSkill
- obsidian-cliSkill
- orchestrateSkill
- plan-reviewSkill
- The first 60 shown.

The file

We split this skill into the rules it gives an agent

1 rule. About 0 are common, 1 is distinctive, and 0 are very specific to this project.

≈0
Common · estimate
Many files like this have a rule of this kind.
≈1
Distinctive · estimate
This author's own choices. Worth a look.
0
Very specific
Tied to their project's names, files or tools. Probably skip.

Common
Distinctive
Very specific

Distinctive:
Use the secure helper script — it handles mode detection, token loading, validation, and expiry:
line 69

≈ “Common” is an estimate: at least 1 in 5 of the 350,495 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.

Keep what fits and drop the rest. Your version, ready for your agents.

Files

SKILL.md

1Password Session for Claude Code

Problem

Claude Code executes each Bash tool call in a new subprocess without TTY. 1Password CLI's app integration binds auth to the terminal session, so every op call triggers a biometric prompt.

Solution

Auto-detect the auth mode and configure accordingly:

Mode	Condition	Behavior
Token	`op signin --raw` returns a token	Cache token in `~/.op-claude-session`; wrapper passes `--session` flag
App Integration	`op signin --raw` returns empty + `op whoami` succeeds	Record mode in session file; wrapper calls `op` directly (IPC with desktop app)

Workflow

/op-session [--account <name>]
     │
     ▼
 op signin --raw
     │
     ├─ token non-empty ──► Token mode
     │                       Verify → write session file → done
     │
     └─ token empty ──► op whoami succeeds?
                          ├─ YES → App Integration mode
                          │        Write session file (no token) → done
                          └─ NO  → ERROR: signin failed

Usage

Initialize Session

bash skills/op-session/scripts/op-session-init.sh
# or with specific account
bash skills/op-session/scripts/op-session-init.sh --account my-team

List Available Accounts

bash skills/op-session/scripts/op-session-init.sh --list

Check Session Status

bash skills/op-session/scripts/op-session-init.sh --check

Clear Session

bash skills/op-session/scripts/op-session-init.sh --clear

Subsequent `op` Calls (Recommended)

Use the secure helper script — it handles mode detection, token loading, validation, and expiry:

bash skills/op-session/scripts/op-with-session.sh read "op://vault/item/field"
bash skills/op-session/scripts/op-with-session.sh item list --vault Production
bash skills/op-session/scripts/op-with-session.sh whoami

The helper:

Auto-detects auth mode from session file (OP_AUTH_MODE)
Token mode: passes --session and --account flags
App mode: passes only --account flag (auth via desktop app IPC)
Validates session before each call
Returns clear error if session is missing, expired, or app is locked

Session Lifecycle

Event	Token Mode	App Integration Mode
Idle timeout	30 min → expires	10 min → expires (auto-refresh on use)
Each `op` call	Resets idle timer	Resets idle timer
Hard limit	12hr	12hr
1Password app locks	Does NOT revoke token	Next `op` call fails until unlocked
`/op-session --clear`	Removes session file	Removes session file

Session File Format

# Token mode
export OP_AUTH_MODE='token'
export OP_SESSION='<session-token>'
export OP_ACCOUNT='<account-id>'

# App Integration mode
export OP_AUTH_MODE='app'
export OP_SESSION=''
export OP_ACCOUNT='<account-id>'

Legacy session files (without OP_AUTH_MODE) are auto-detected as token mode if OP_SESSION is non-empty.

Security

Aspect	Token Mode	App Integration Mode
Token at rest	`~/.op-claude-session` (owner-only via `umask 077`)	No token stored
Process args	`--session $TOKEN` visible to same-user processes	No `--session` flag
Auth control	Token possession = access	Desktop app biometric
Scope	All vaults you can access	All vaults you can access
Risk level	Moderate (token on disk)	Lower (no token on disk)
Mitigation	Short-lived token, `--clear` when done	App auto-manages session

Known Limitations

Limitation	Cause	Workaround
`ls` on home-dir paths blocked in `!` context checks	Claude Code sandbox may restrict `ls`/`find` to working directory in command template expansion	Use `test -f` via `bash -c` wrapper; see `skills/op-session/SKILL.md`
`allowed-tools` cannot be narrowed to specific script paths	`${CLAUDE_PLUGIN_ROOT}` unavailable in command markdown (#9354)	Keep `Bash(bash:*)` until upstream fix
Context check is best-effort UI	Sandbox policy may tighten	Authoritative status via `bash skills/op-session/scripts/op-session-init.sh --check`
App mode fails when desktop app is locked	CLI cannot IPC with locked app	Unlock 1Password app, or run `/op-session` to reinitialize

Prerequisites

1Password CLI (op) installed and configured
1Password desktop app running (for initial biometric auth)
Account signed in to 1Password app

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

Reviews can't be read right now.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free