Skills 1Password Credential Lookup
📦

1Password Credential Lookup

v2.0.0 Content revision r2 High Risk ⚙️ External commands

Find website credentials by domain

Finding the correct login item is difficult when item titles do not match website names. This skill searches saved 1Password URLs and can filter results by username.

Supports: Claude Codex Code(CC)
⚠️ 38 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "1Password Credential Lookup" from https://skillstore.io/skills/clementwalter-1password-credential-lookup.md and its manifest at https://skillstore.io/api/skills/clementwalter-1password-credential-lookup/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/clementwalter-1password-credential-lookup.md Signed manifest GET /api/skills/clementwalter-1password-credential-lookup/manifest Signed lockfile GET /api/skills/clementwalter-1password-credential-lookup/lockfile

Test it

Using "1Password Credential Lookup". Find the login for github.com using work@example.com.

Expected outcome:

  • Matched account: work@example.com
  • Login item found for github.com
  • Password remains protected until confirmation

Using "1Password Credential Lookup". List accounts for github.com.

Expected outcome:

  • Two accounts found
  • work@example.com
  • personal@example.com
  • Select a username to continue

Using "1Password Credential Lookup". Find the login for unknown.example.

Expected outcome:

No saved login was found for the requested domain.

Security Audit

High Risk
v10 • 7/18/2026 Open versioned report

Static findings in Markdown and fixed 1Password CLI invocation are false positives. The skill intentionally retrieves credentials, but it prints plaintext passwords and uses overbroad substring matching that can select credentials for an unrelated saved URL.

2
Files scanned
252
Lines analyzed
0
Review items
0
False positives ignored

Confirmed security concerns (2)

High
scripts/find_credential.py:114-120SKILL.md:49-50
Plaintext credential disclosure through command output
The credential lookup path includes username and password values in JSON written to standard output. Any agent or process that receives this output can access the plaintext password.
The script constructs output objects from extracted password fields at both locations, and the documentation explicitly describes password-bearing output.
High
scripts/find_credential.py:72-75
Overbroad domain matching can select unrelated credentials
URL matching accepts a requested domain when it appears anywhere in a saved URL. A domain such as github.com.evil.example can match github.com and may return an unintended credential.
The code uses substring containment rather than validating the parsed hostname or a domain boundary.

Risk Factors

⚙️ External commands (27)
scripts/find_credential.py:30 SKILL.md:13-16 SKILL.md:16-20 SKILL.md:20-23 SKILL.md:23-27 SKILL.md:27-29 SKILL.md:29-33 SKILL.md:33-37 SKILL.md:37-40 SKILL.md:40-44 SKILL.md:44-45 SKILL.md:45-49 SKILL.md:49-53 SKILL.md:53-55 SKILL.md:55-57 SKILL.md:57-59 SKILL.md:59-61 SKILL.md:61-63 SKILL.md:63-69 SKILL.md:69-78 SKILL.md:78-84 SKILL.md:84 SKILL.md:91-93 SKILL.md:93-99 SKILL.md:99-100 SKILL.md:100-101 SKILL.md:101-105
Audited by: claude View Audit History →
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/clementwalter-1password-credential-lookup/audits/10?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/clementwalter-1password-credential-lookup/security.svg)](https://skillstore.io/skills/clementwalter-1password-credential-lookup?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/clementwalter-1password-credential-lookup?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/clementwalter-1password-credential-lookup/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/clementwalter-1password-credential-lookup.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

ClementWalter. (2026). 1Password Credential Lookup security audit report (audit version 10) [Author version 2.0.0]. Skillstore. https://skillstore.io/skills/clementwalter-1password-credential-lookup/audits/10

BibTeX citation

@techreport{clementwalter-clementwalter-1password-credential-lookup-2026, author = {ClementWalter}, title = {1Password Credential Lookup security audit report (audit version 10)}, institution = {Skillstore}, year = {2026}, number = {10}, url = {https://skillstore.io/skills/clementwalter-1password-credential-lookup/audits/10}, note = {Author version 2.0.0} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "1Password Credential Lookup security audit report (audit version 10)" version: "2.0.0" type: report authors: - name: "ClementWalter" date-released: "2026-07-18" url: "https://skillstore.io/skills/clementwalter-1password-credential-lookup/audits/10" identifiers: - type: other value: "skillstore:clementwalter-1password-credential-lookup:audit:10" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium
45
Architecture
100
Maintainability
87
Content
70
Community
83
Spec Compliance

What You Can Build

Open a known website account

Find a saved login for a website before an approved sign-in action.

Choose a work account

List matching accounts and filter by username when a website has several saved logins.

Troubleshoot credential lookup

Identify missing CLI installation, sign-in, or no-match conditions during local automation.

Try These Prompts

Find a website login 
Find my 1Password credential for github.com. Ask for confirmation before revealing any password.
Filter by username 
Find the 1Password login for linkedin.com using the username work@example.com. Show only the matching account name until I confirm.
Resolve several accounts 
List my saved accounts for github.com without passwords. Ask me which username I want before retrieving credentials.
Use an approved login 
For the approved site github.com, find the login for work@example.com and use it only to complete the current sign-in. Do not display or log the password.

Best Practices

  • Confirm the website domain and intended account before retrieving a password.
  • Use a username filter when multiple accounts are available.
  • Keep passwords out of chat history, logs, and terminal output whenever possible.

Avoid

  • Do not guess 1Password item names from a website name.
  • Do not retrieve a password before the user confirms the selected account.
  • Do not rely on substring domain matches for sensitive login decisions.

Frequently Asked Questions

What does this skill search?
It searches saved 1Password login items using the website URL field.
What software is required?
You need the 1Password CLI installed and signed in locally.
Can I select a specific account?
Yes. Provide the username when more than one login may exist.
Why should I use a domain instead of an item name?
Item titles can be arbitrary, while saved URLs usually identify the website.
Does it support domain aliases?
It treats x.com and twitter.com as equivalent.
Are passwords protected in the output?
No. The current script returns plaintext passwords, so use it only with explicit approval and secure output handling.

Developer Details

License

MIT

Author version

v2.0.0

Skillstore revision

r2

Version notice

The installable content changed, but the author did not update the declared version.

Repository

https://github.com/ClementWalter/rookie-marketplace/tree/main/1password-mcp/skills/credential-lookup

Ref

c68df504887c54bf71d2d467a1fbebde49467868

Maintenance freshness

7/19/2026

Usage

4 downloads · 224 views

File structure

📁 scripts/

📄 find_credential.py

📄 SKILL.md