Skip to content
skillsafebeta
← Report library
Purpose / Other

Opencli Usage Skill Security Audit

What the author says it does (original text)

Use at the start of any OpenCLI session — this is the top-level map of what `opencli` can do, how to discover adapters, what flags and output formats are universal, and which specialized skill to load next. Point here when an agent asks "what can opencli do?" or "how do I find the right command?".

Independent security check

Do not install or run it yet

Files checked
1
Risks found
7
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 2
High risk

Can install third-party plugins from arbitrary Git repositories

Source references: 1
What we found

The plugin command accepts a `github:user/repo` source, meaning code from a third-party repository. The provided Skill does not require pinning a commit, verifying signatures, reviewing code, or sandboxing execution.

Why this matters

A malicious or compromised plugin could read files, obtain session data, execute commands, or change accounts within OpenCLI's permissions.

Plugins are described as third-party extensions pulled from Git, and the install interface accepts a GitHub repository identifier; updating can also retrieve later code. The shown workflow has no commit pinning or review step, so installation or update introduces repository code into the OpenCLI environment. Users can permit only reviewed, commit-pinned repositories and validate them in isolation.

SKILL.md:113In the instructionsOpen original file
Plugins are third-party extensions pulled from git, separate from the main adapter registry:```bashopencli plugin install github:user/repo    # installopencli plugin list [-f json]              # see installedopencli plugin update [name] | --all       # keep currentopencli plugin uninstall <name>opencli plugin create <name>               # scaffold a new plugin
High risk

External CLI registration can store and run arbitrary installation commands

Source references: 3
What we found

The `external register` example accepts a free-form `--install` command, while installation may also proceed automatically through brew, apt, or npm; executed tools inherit standard I/O. The catalog can be overridden by YAML in the user directory, so a command name alone does not establish what will actually be installed.

Why this matters

A tampered catalog or untrusted registration could install and execute different software, while inherited I/O may expose interactive input or authentication prompts to it.

External CLIs may be auto-installed through brew, apt, or npm, and registration accepts a free-form installation string; invoked programs inherit standard I/O. A user-directory file can override built-in entries, so a familiar name may resolve to different configuration. If used, installers and programs run with the user's process privileges. Users can disable auto-install and overrides and allow only reviewed absolute binary paths.

SKILL.md:128In the instructionsOpen original file
```bashopencli external install gh    # auto-install via brew/apt/npm per external-clis.yamlopencli external register my-tool \    --binary my-tool \    --install "npm i -g my-tool" \    --desc "My internal CLI"opencli external listopencli gh pr list --limit 5   # passthrough; stdio is inherited, exit code propagatedopencli docker ps
Show 2 other places
SKILL.md:138In the instructionsOpen original file
Built-in entries live in `src/external-clis.yaml`; user overrides and additions in `~/.opencli/external-clis.yaml`. Commonly shipped: `gh`, `docker`, `vercel`, `lark-cli`, `longbridge`, `dws`, `wecom-cli`, `obsidian`, `ntn`, `tg(tg-cli)`, `discord(discord-cli)`, `wx(wx-cli)`.
SKILL.md:127In the instructionsOpen original file
```bashopencli external install gh    # auto-install via brew/apt/npm per external-clis.yamlopencli external register my-tool \    --binary my-tool \    --install "npm i -g my-tool" \    --desc "My internal CLI"opencli external listopencli gh pr list --limit 5   # passthrough; stdio is inherited, exit code propagatedopencli docker ps
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

Network captures and browser state are persisted locally

Source references: 2
What we found

The Skill explicitly stores network captures and browser state under `~/.opencli/cache`, and retained failure traces preserve browser evidence. The supplied material does not describe encryption, automatic deletion, or sensitive-field redaction.

Why this matters

The cache may contain request content, page state, or authentication-related material that other local processes, backups, or later diagnostics could access.

The configuration table places a “network capture + browser-state cache” in the user's home directory, and the repair workflow retains traces containing browser evidence. These artifacts may contain sensitive session or page information; no retention or protection policy is stated here. Users can restrict cache-directory permissions and ask about redaction, encryption, and cleanup.

SKILL.md:85In the instructionsOpen original file
| `OPENCLI_CDP_ENDPOINT` | — | Manual CDP endpoint override (dev / remote Chrome / Electron). || `OPENCLI_CACHE_DIR` | `~/.opencli/cache` | Network capture + browser-state cache. || `OPENCLI_WINDOW` | command-specific | `foreground` or `background` browser window mode. |
Show 1 other places
SKILL.md:91In the instructionsOpen original file
When an adapter command fails because the site changed (selectors drifted, API rotated, response schema shifted), re-run with `--trace retain-on-failure`. The error envelope includes a `trace` block pointing at `summary.md`; patch only the `adapterSourcePath` from that summary and retry. Max 3 repair rounds. The full flow is in `opencli-autofix`.
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.Risks found: 1
Medium risk

Failure-repair workflow directly modifies adapter source

Source references: 1
What we found

When a site changes, the Skill directs the agent to patch the file named by `adapterSourcePath` in a trace summary and retry, for up to three rounds. It does not require showing the diff or obtaining user confirmation first, and the path comes from command-generated failure material rather than an explicit user-selected target.

Why this matters

An incorrect or manipulated trace could cause persistent changes to the wrong file, alter adapter behavior, and execute the new logic against a logged-in session during retry.

This is an active self-repair instruction: retain a trace, obtain adapterSourcePath from generated summary.md, patch that source file, and retry for up to three rounds. Although limited to one adapter file, it changes local code without a stated human-review step and may repeatedly execute the modified adapter. Users can require the target path and diff before each round and permit writing and retrying only after explicit approval.

SKILL.md:91In the instructionsOpen original file
When an adapter command fails because the site changed (selectors drifted, API rotated, response schema shifted), re-run with `--trace retain-on-failure`. The error envelope includes a `trace` block pointing at `summary.md`; patch only the `adapterSourcePath` from that summary and retry. Max 3 repair rounds. The full flow is in `opencli-autofix`.
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 3
High risk

Can use credentials from logged-in sessions and operate website accounts

Source references: 2
What we found

COOKIE commands explicitly capture credentials from a live Chrome session, INTERCEPT can capture signed requests, and the UI strategy provides full DOM interaction. Although current-tab binding claims to block tab mutation, other browser or UI workflows still include clicking, typing, and selecting.

Why this matters

If the agent selects these strategies, commands may read private content or perform account actions as the user, with the authority of that logged-in session.

These are active capabilities: browser commands include clicking, typing, and selecting; COOKIE captures a credential from a logged-in Chrome session, INTERCEPT captures a signed request, and UI performs full DOM interaction. When invoked, they could read account data or act on the user's behalf. Users can restrict the sites, commands, and permitted writes and use a dedicated low-privilege session.

SKILL.md:14In the instructionsOpen original file
- **Adapter commands** — `opencli <site> <command> [...]`. Built-in adapters live in `clis/`, user adapters in `~/.opencli/clis/`. Each is backed by a strategy (`PUBLIC | COOKIE | INTERCEPT | UI | LOCAL`) that tells you whether a Chrome session is needed.- **Browser driving** — `opencli browser *` subcommands (`open`, `state`, `click`, `type`, `select`, `find`, `extract`, `network`, …) for ad-hoc interaction and scraping when no adapter covers the task. See `opencli-browser`.- **Current-tab binding** — `opencli browser <session> bind` attaches the Chrome tab the user already opened/logged into to that browser session. Follow-up commands use `opencli browser <session> ...`. See `opencli-browser` before using it; bound sessions still block tab mutation.- **External CLI passthrough** — `opencli gh`, `opencli docker`, `opencli vercel`, etc. Managed via `opencli external install <name>` (auto-install from `external-clis.yaml`) or `opencli external register <name>` (bring your own).
Show 1 other places
SKILL.md:38In the instructionsOpen original file
| `PUBLIC` | Nothing — pure HTTP, no browser. || `COOKIE` | Chrome logged into the target site + **OpenCLI** extension installed from the [Chrome Web Store](https://chromewebstore.google.com/detail/opencli/ildkmabpimmkaediidaifkhjpohdnifk). Command captures the credential from your live session — no re-login. || `INTERCEPT` | Same as COOKIE, plus opencli opens an automation window to capture a signed request. || `UI` | Same as COOKIE, full DOM interaction. || `LOCAL` | No browser; talks to a local/dev endpoint. |
High risk

Can access logged-in desktop applications through CDP

Source references: 1
What we found

The Skill directs OpenCLI to connect through CDP to running Electron applications including Cursor, Codex, Discord, and ChatGPT, describing access similar to a logged-in browser. The provided material does not limit which data or application functions are reachable.

Why this matters

A connection could expose conversations, workspace content, account sessions, or functions capable of acting for the user.

The document explicitly routes through CDP to running, logged-in Electron apps including Cursor, Codex, Discord, and ChatGPT. This exposes an authenticated application context, although the supplied source does not identify the exact data or actions available. Users can require per-adapter permission boundaries and close unrelated apps or use isolated accounts.

SKILL.md:43In the instructionsOpen original file
Electron desktop apps (cursor, codex, chatwise, discord-app, doubao-app, antigravity, chatgpt-app) route through CDP against the running app — same cookie-less flow as a logged-in browser. Make sure the app is running before invoking.
Low risk

The install command does not pin a dependency version

Source references: 3
What we found

The installation command does not specify dependency versions. The same command may download different code later, so what you install can differ from what was checked.

Why this matters

A later install may download different code even though the command and this report have not changed.

The installation instructions do not pin an OpenCLI npm version. The source-based method also clones the repository's current default branch and installs dependencies as resolved at that time, so later runs may obtain different code. A user can ask for a pinned version, commit hash, and lockfile verification procedure.

SKILL.md:28In the instructionsOpen original file
cd OpenCLI && npm installnpx tsx src/main.ts <command>               # same surface, no global install```
Show 2 other places
SKILL.md:22In the instructionsOpen original file
# npm globalnpm install -g @jackwener/opencli          # binary: opencli, requires Node >= 21opencli doctor                              # run before browser-dependent work (see below)
SKILL.md:26In the instructionsOpen original file
# From sourcegit clone git@github.com:jackwener/OpenCLI.gitcd OpenCLI && npm installnpx tsx src/main.ts <command>               # same surface, no global install```
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

8 instruction sections

This Skill is an orientation guide for OpenCLI: it directs the agent to enumerate installed site adapters first, then choose an adapter, browser control, or external CLI for the task.

View source
SKILL.md:48In the instructionsOpen original file
```bashopencli list                    # table, grouped by siteopencli list -f json            # machine-readable; pipe to jq or your agentopencli list | grep -i twitter  # find commands for a specific siteopencli <site> --help           # see that site's commands + flagsopencli <site> <command> --help # see positional args and command-specific flags```

Some adapters depend on a logged-in Chrome session and obtain credentials from that live session; browser subcommands can also click, type, select, extract, and inspect network activity.

View source
SKILL.md:14In the instructionsOpen original file
- **Adapter commands** — `opencli <site> <command> [...]`. Built-in adapters live in `clis/`, user adapters in `~/.opencli/clis/`. Each is backed by a strategy (`PUBLIC | COOKIE | INTERCEPT | UI | LOCAL`) that tells you whether a Chrome session is needed.- **Browser driving** — `opencli browser *` subcommands (`open`, `state`, `click`, `type`, `select`, `find`, `extract`, `network`, …) for ad-hoc interaction and scraping when no adapter covers the task. See `opencli-browser`.- **Current-tab binding** — `opencli browser <session> bind` attaches the Chrome tab the user already opened/logged into to that browser session. Follow-up commands use `opencli browser <session> ...`. See `opencli-browser` before using it; bound sessions still block tab mutation.- **External CLI passthrough** — `opencli gh`, `opencli docker`, `opencli vercel`, etc. Managed via `opencli external install <name>` (auto-install from `external-clis.yaml`) or `opencli external register <name>` (bring your own).
SKILL.md:38In the instructionsOpen original file
| `PUBLIC` | Nothing — pure HTTP, no browser. || `COOKIE` | Chrome logged into the target site + **OpenCLI** extension installed from the [Chrome Web Store](https://chromewebstore.google.com/detail/opencli/ildkmabpimmkaediidaifkhjpohdnifk). Command captures the credential from your live session — no re-login. || `INTERCEPT` | Same as COOKIE, plus opencli opens an automation window to capture a signed request. || `UI` | Same as COOKIE, full DOM interaction. || `LOCAL` | No browser; talks to a local/dev endpoint. |

It also supports connecting to running desktop applications through CDP and caches network captures and browser state in the user's directory.

View source
SKILL.md:43In the instructionsOpen original file
Electron desktop apps (cursor, codex, chatwise, discord-app, doubao-app, antigravity, chatgpt-app) route through CDP against the running app — same cookie-less flow as a logged-in browser. Make sure the app is running before invoking.
SKILL.md:85In the instructionsOpen original file
| `OPENCLI_CDP_ENDPOINT` | — | Manual CDP endpoint override (dev / remote Chrome / Electron). || `OPENCLI_CACHE_DIR` | `~/.opencli/cache` | Network capture + browser-state cache. || `OPENCLI_WINDOW` | command-specific | `foreground` or `background` browser window mode. |

The guide permits installing third-party plugins from Git repositories and installing, registering, and running external command-line programs.

View source
SKILL.md:113In the instructionsOpen original file
Plugins are third-party extensions pulled from git, separate from the main adapter registry:```bashopencli plugin install github:user/repo    # installopencli plugin list [-f json]              # see installed
SKILL.md:128In the instructionsOpen original file
```bashopencli external install gh    # auto-install via brew/apt/npm per external-clis.yamlopencli external register my-tool \    --binary my-tool \    --install "npm i -g my-tool" \    --desc "My internal CLI"opencli external listopencli gh pr list --limit 5   # passthrough; stdio is inherited, exit code propagatedopencli docker ps
Start here · InstructionsSKILL.md
opencli-usage
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source. 7 more sections are available in the original file.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Run commands
SKILL.md:4In the instructionsOpen original file
description: Use at the start of any OpenCLI session — this is the top-level map of what `opencli` can do, how to discover adapters, what flags and output formats are universal, and which specialized skill to load next. Point here when an a …allowed-tools: Bash(opencli:*), Read---
SKILL.md:20In the instructionsOpen original file
```bash# npm global
SKILL.md:47In the instructionsOpen original file
```bashopencli list                    # table, grouped by site
Install extra software packages
SKILL.md:22In the instructionsOpen original file
# npm globalnpm install -g @jackwener/opencli          # binary: opencli, requires Node >= 21opencli doctor                              # run before browser-dependent work (see below)
SKILL.md:27In the instructionsOpen original file
git clone git@github.com:jackwener/OpenCLI.gitcd OpenCLI && npm installnpx tsx src/main.ts <command>               # same surface, no global install
SKILL.md:28In the instructionsOpen original file
cd OpenCLI && npm installnpx tsx src/main.ts <command>               # same surface, no global install```
Connect to websites
SKILL.md:38In the instructionsOpen original file
| `PUBLIC` | Nothing — pure HTTP, no browser. || `COOKIE` | Chrome logged into the target site + **OpenCLI** extension installed from the [Chrome Web Store](https://chromewebstore.google.com/detail/opencli/ildkmabpimmkaediidaifkhjpohdnifk). Command captures the credential from your live session — no re-login. || `INTERCEPT` | Same as COOKIE, plus opencli opens an automation window to capture a signed request. |
Read files
SKILL.md:45In the instructionsOpen original file
## Discover what's installed — don't read this file, run a command
Lines read
171
File checksum (to compare versions)
f03de0904f88919a4a97dd181bc18437e4dff191250b6d83d780f9de27aa45a9