opencli

• Analyzed: Mar 27, 2026, 6:51 AM
• Findings: 1
• Version: 1.0.0
• Hash: 1bc999de6b0786ebb42c6f8fed53eb223aa5066ee89d254efd6fb0d561f6da7a
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle provides the agent with broad access to sensitive personal data (DMs, bookmarks, history) and the ability to perform write actions (posting, deleting) across 16 social platforms by reusing the user's Chrome session. SKILL.md includes 'self-iteration' instructions that direct the agent to write YAML configuration files to the local filesystem (~/.opencli/clis/) and use browser_evaluate to explore DOM structures. While these capabilities are aligned with the tool's stated purpose of being a CLI for web services, the combination of extensive account access and local file-writing permissions presents a high-risk profile.