opencli

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:48 AM UTC
• Version: 1.0.0

Overview

This skill is a broad browser and website automation hub that is coherent with its purpose, but it grants high-impact access to logged-in Chrome sessions and automatic CLI installation without clear approval boundaries.

Install only if you are comfortable with a skill that can drive your logged-in Chrome session, inspect pages, take screenshots, click and type into sites, and trigger installation of missing external command-line tools. Use it in a constrained environment and require your own confirmation before sensitive browser, account, Docker, GitHub, or Obsidian actions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:50

Finding

Uncontrolled Automatic Installation of Third-Party CLI Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 50–55 and 57–62
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

markdown

### 外部 CLI Hub（自动安装）
```bash
opencli gh pr list --limit 5        # GitHub CLI
opencli docker ps                    # Docker
opencli obsidian search "关键词"     # Obsidian

执行规则

1. 公开命令直接执行：opencli <site> <command> [args]
2. 需要登录的命令先检查：确保 Chrome 已登录目标网站
3. operate 命令链式调用：用 && 合并多个操作减少往返
4. 自动安装：如果外部 CLI 不存在，opencli 会自动尝试安装

text

### Technical Analysis

The Skill authorizes `opencli` to install missing third-party command-line tools automatically. It does not specify trusted registries or download domains, exact package identifiers, pinned versions, cryptographic hashes, signature verification, or an explicit user-approval step.

The `opencli` implementation and its installation logic are not included in the audited project. Consequently, the package resolution, download, integrity validation, and installer execution behavior cannot be verified. This creates an unaudited supply-chain execution path in which mutable remote packages or installers may run with the privileges available to the agent.

An attacker could exploit this behavior by compromising an upstream registry or distribution source, publishing a malicious package under an incorrectly resolved or confusing name, or tampering with an unverified download. The current project does not establish that these attacks are occurring, but its documented automatic installation behavior exposes the execution path.

### Attack Path

1. A user requests an operation backed by an external CLI, such as GitHub, Docker, or Obsidian access.
2. The agent invokes the corresponding `opencli` command according to the Skill instructions.
3. `opencli` determines that the required external CLI is absent.
4. The documented automatic-installation feature resolves and retrieves a third-party package or installer.
5. If th
...[truncated 838 chars]

Remediation

View remediation

Remediation Suggestions

1. Disable automatic installation during ordinary command execution.
2. Require explicit, informed user approval before downloading or installing any external tool.
3. Maintain an allowlist containing exact official package names, trusted registries, and approved download domains.
4. Pin each dependency to a reviewed version and verify cryptographic hashes or publisher signatures before execution.
5. Reject ambiguous, untrusted, redirected, or unsigned package sources.
6. Separate installation from operational commands so invoking a normal CLI action cannot silently add executable software.
7. Perform installation with least privilege in a sandbox or isolated environment, without access to authenticated browser sessions or sensitive local data.
8. Record the resolved package name, version, source, integrity value, and approval decision in an audit log.
9. Include the opencli installer implementation and dependency manifest in the review scope so package resolution and verification behavior can be independently audited.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill documents capabilities that can interact with logged-in websites, take screenshots, inspect page state, and automatically install external CLIs, but it does not warn the user about these behaviors or require explicit consent. In context, this is especially dangerous because the skill can leverage an existing Chrome session and extend itself by installing tools, creating risk of privacy exposure, unintended account actions, and supply-chain compromise.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger text is extremely broad, matching generic requests about websites, scraping, browser control, and even any mention of opencli commands. This can cause the skill to activate in situations the user did not clearly intend, increasing the chance of unsolicited browser automation, access to logged-in sessions, or execution of sensitive commands through the hub.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.