Lap 1password Connect
v1.0.11Password Connect API skill. Use when working with 1Password Connect for activity, vaults, heartbeat. Covers 15 endpoints.
0· 205·1 当前·1 累计
安全扫描
OpenClaw
安全
high confidenceThe skill is internally consistent with its stated purpose (1Password Connect access) and only requests a single, appropriate API key; no installs or unrelated privileges are requested.
评估建议
This skill appears to do what it says: talk to a local 1Password Connect server using the provided 1PASSWORD_CONNECT_API_KEY. Before installing, confirm the following: (1) the base URL (http://localhost:8080/v1) points to the Connect server you intend to use — if you plan to use a remote host, understand the network implications; (2) the API key you provide has minimal required scope and is treated as a secret (rotate/revoke if exposed); (3) if you do not want the agent to call the API autonomou...详细分析 ▾
✓ 用途与能力
Name/description, declared env var (1PASSWORD_CONNECT_API_KEY), and the listed endpoints (vaults, activity, heartbeat, health, metrics) align with a 1Password Connect integration. There are no unrelated binaries, configs, or credentials requested.
ℹ 指令范围
The SKILL.md instructs the agent to call local 1Password Connect endpoints (base URL http://localhost:8080/v1) and to use a Bearer token from 1PASSWORD_CONNECT_API_KEY — this is appropriate for the stated purpose. The doc also suggests running npx @lap-platform/lapsh to fetch references/api-spec.lap (a CLI/network operation) — that is optional documentation tooling and not required for API use; if executed it will perform a network fetch and requires npm. The skill's runtime instructions do not ask the agent to read arbitrary local files or exfiltrate data to third-party endpoints.
✓ 安装机制
No install spec or code is included (instruction-only), so nothing will be downloaded or written to disk by the skill itself.
ℹ 凭证需求
Only a single env var (1PASSWORD_CONNECT_API_KEY) is required, which is proportional to a Connect API skill. However, that API key grants access to vaults and items according to its privileges — treat it as highly sensitive and prefer least-privilege keys and scoped service accounts.
✓ 持久化与权限
always is false and there is no install or persistent modification of agent/system state. The skill can be invoked autonomously by the agent (disable-model-invocation is false), which is the platform default; this is expected behavior but worth noting because an autonomous agent could call the 1Password API using the provided key.
安全有层次,运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.12026/3/16
- Rolled back 1Password Connect API version from 1.7.1 to 1.5.7 in documentation. - Added a CLI section with commands to update the API spec and search for related APIs. - No changes to endpoints or usage instructions.
● 无害
安装命令 点击复制
官方npx clawhub@latest install lap-1password-connect
镜像加速npx clawhub@latest install lap-1password-connect --registry https://cn.clawhub-mirror.com
技能文档
API version: 1.5.7
Auth
Bearer bearerBase URL
http://localhost:8080/v1Setup
- Set Authorization header with your Bearer token
- GET /activity -- verify access
- POST /vaults/{vaultUuid}/items -- create first items
Endpoints
15 endpoints across 5 groups. See references/api-spec.lap for full details.
activity
| Method | Path | Description |
|---|---|---|
| GET | /activity | Retrieve a list of API Requests that have been made. |
vaults
| Method | Path | Description |
|---|---|---|
| GET | /vaults | Get all Vaults |
| GET | /vaults/{vaultUuid} | Get Vault details and metadata |
| GET | /vaults/{vaultUuid}/items | Get all items for inside a Vault |
| POST | /vaults/{vaultUuid}/items | Create a new Item |
| GET | /vaults/{vaultUuid}/items/{itemUuid} | Get the details of an Item |
| PUT | /vaults/{vaultUuid}/items/{itemUuid} | Update an Item |
| DELETE | /vaults/{vaultUuid}/items/{itemUuid} | Delete an Item |
| PATCH | /vaults/{vaultUuid}/items/{itemUuid} | Update a subset of Item attributes |
| GET | /vaults/{vaultUuid}/items/{itemUuid}/files | Get all the files inside an Item |
| GET | /vaults/{vaultUuid}/items/{itemUuid}/files/{fileUuid} | Get the details of a File |
| GET | /vaults/{vaultUuid}/items/{itemUuid}/files/{fileUuid}/content | Get the content of a File |
heartbeat
| Method | Path | Description |
|---|---|---|
| GET | /heartbeat | Ping the server for liveness |
health
| Method | Path | Description |
|---|---|---|
| GET | /health | Get state of the server and its dependencies. |
metrics
| Method | Path | Description |
|---|---|---|
| GET | /metrics | Query server for exposed Prometheus metrics |
Common Questions
Match user requests to endpoints in references/api-spec.lap. Key patterns:
- "List all activity?" -> GET /activity
- "List all vaults?" -> GET /vaults
- "Get vault details?" -> GET /vaults/{vaultUuid}
- "List all items?" -> GET /vaults/{vaultUuid}/items
- "Create a item?" -> POST /vaults/{vaultUuid}/items
- "Get item details?" -> GET /vaults/{vaultUuid}/items/{itemUuid}
- "Update a item?" -> PUT /vaults/{vaultUuid}/items/{itemUuid}
- "Delete a item?" -> DELETE /vaults/{vaultUuid}/items/{itemUuid}
- "Partially update a item?" -> PATCH /vaults/{vaultUuid}/items/{itemUuid}
- "List all files?" -> GET /vaults/{vaultUuid}/items/{itemUuid}/files
- "Get file details?" -> GET /vaults/{vaultUuid}/items/{itemUuid}/files/{fileUuid}
- "List all content?" -> GET /vaults/{vaultUuid}/items/{itemUuid}/files/{fileUuid}/content
- "List all heartbeat?" -> GET /heartbeat
- "List all health?" -> GET /health
- "List all metrics?" -> GET /metrics
- "How to authenticate?" -> See Auth section
Response Tips
- Check response schemas in references/api-spec.lap for field details
- List endpoints may support pagination; check for limit, offset, or cursor params
- Create/update endpoints typically return the created/updated object
CLI
# Update this spec to the latest version
npx @lap-platform/lapsh get 1password-connect -o references/api-spec.lap# Search for related APIs
npx @lap-platform/lapsh search 1password-connect
References
- Full spec: See references/api-spec.lap for complete endpoint details, parameter tables, and response schemas
Generated from the official API spec by LAP
数据来源:ClawHub ↗ · 中文优化:龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险,如需更匹配、更安全的方案,建议联系付费定制