op-signin — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited op-signin (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Sign the user in to 1Password CLI and confirm success.
op whoamiIf it succeeds, the user is authed. Report the account info from the output and stop.
op whoami fails with "no signed-in accounts", run: op signin $ARGUMENTSop signin is idempotent and uses the desktop app integration — it will trigger biometric (Touch ID / Windows Hello / system auth). If the desktop app integration isn't enabled, the command will print instructions; do not retry, instead relay the instructions to the user.
op whoami again to confirm and report the account.--account <shorthand> in $ARGUMENTS, that account is selected. Otherwise the most-recently-used account is used (per OP_ACCOUNT env var if set).OP_SERVICE_ACCOUNT_TOKEN is setDon't run op signin — service-account auth is automatic. Just run op whoami and report the service account identity.
Don't try to install or configure 1Password automatically — these are one-time interactive setup steps.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.