Security audit
Security checks for vulnerabilities and agentic risk
This skill is a documented sitemap-authoring helper that stores scoped site-navigation notes locally and does not include hidden code or install-time behavior.
Install only if you want OpenCLI agents to keep reusable, site-specific navigation notes under ~/.opencli. Review generated sitemap and trace-derived content for private data, especially on logged-in sites, and be aware that parts of the guidance are Chinese-only.
The markdown includes substantial Chinese-language guidance and mixed-language terminology in the main authoring instructions, which effectively assumes Chinese proficiency from the user or agent operator. The file does not provide an opt-in, alternative language, or justification that this skill is region- or locale-specific.
The skill instructs the agent to persist site-specific drafts under a user home directory and to seed future work from retained browser traces. Even though the document says not to store secrets, this creates a durable local memory channel that can capture sensitive browsing artifacts, account-specific structure, or residual trace data and reuse them across sessions, increasing the chance of unintended disclosure or cross-task data leakage.
2. **Verify reality**: use `opencli browser <session> state`, `find`, `network`, and `analyze`; browser state is truth. If you just completed an `opencli-adapter-author` session for this site, start from the retained browse trace under `~/.opencli/sites/<site>/traces/` as seed evidence instead of re-discovering the path from zero.
3. **Record only durable structure**: page purpose, stable anchors, state signature, actions, workflows, API references, pitfalls.
4. **Use stable ids**: page/action/workflow ids should survive URL params, locale text drift, and minor layout changes.
5. **Write local draft**: update `~/.opencli/sites/<site>/sitemap/...` unless explicitly promoting to repo.
6. **Mark stale on conflict**: if existing sitemap disagrees with current browser state, trust browser state and mark the item stale rather than forcing the old path.
---
This duplicate finding points to the same persistence behavior: future agents are instructed to consume locally stored adapter-health state. Persistent local state can leak task history or be manipulated to bias later actions if the overlay is not isolated, auditable, and sanitized.
Use this compact form by default. Use the longer Markdown form from `references/sitemap-schema.md` only when an action genuinely needs long explanation. `verified_at` and `source` are inherited from file frontmatter; do not repeat them per action.
Do not promote an action without evidence. If a recovery path marks `adapter_health_update`, the browser-sitemap consumer must write that health update to the local overlay so the next agent does not retry a known-suspect adapter.
### Partial pages（跨页通用 UI）
This duplicate finding points to the same persistence behavior: future agents are instructed to consume locally stored adapter-health state. Persistent local state can leak task history or be manipulated to bias later actions if the overlay is not isolated, auditable, and sanitized.
Use this compact form by default. Use the longer Markdown form from `references/sitemap-schema.md` only when an action genuinely needs long explanation. `verified_at` and `source` are inherited from file frontmatter; do not repeat them per action.
Do not promote an action without evidence. If a recovery path marks `adapter_health_update`, the browser-sitemap consumer must write that health update to the local overlay so the next agent does not retry a known-suspect adapter.
### Partial pages(跨页通用 UI)
This section again switches into Chinese for normative instructions and examples, reinforcing a language-specific requirement in the skill body. Because the skill does not ask the user to choose a language or explain why Chinese is required, this conflicts with the language/locale policy criteria.
The fallback convention and route-coverage guidance are written largely in Chinese, making key operational requirements dependent on one language. Without explicit opt-in or documented locale justification, this is a natural-language policy violation under the stated rules.
The document body is written in Chinese and assumes readers will consume the schema specification in that language, but it does not offer an alternative language, opt-in, or justification for the locale restriction. Under the policy, forcing a specific language without user choice is a natural-language policy violation.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- triggered_by_actions: [search_input_keystroke]
- contract_strength: internal-unstable
### endpoint:post_create
- triggers_on_pages: [home, compose]
- triggered_by_actions: [submit_post]
- contract_strength: internal-unstable
No suspicious patterns detected.