Security audit

opencli zh

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for using opencli, but it needs review because it combines logged-in browser access, persistent adapter writes, unpinned global installation, and unsafe command-template guidance.

Install only if you are comfortable with opencli touching logged-in browser-backed services and writing persistent files under ~/.opencli. Prefer a pinned, reviewed opencli version, require explicit confirmation for writes, browser-state diagnostics, and adapter generation, and do not pass untrusted URL/site/goal text through shell command strings.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:15
Finding: Unpinned Globally Installed Executable Dependency
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: guides/custom-adapters.md:13
Finding: Shell Command Injection Risk in Custom-Adapter Command Templates
Content: View full analysis
--goal "<目标>" ``` ```bash opencli explore --site opencli cascade ``` ### Technical Analysis The custom-adapter workflow instructs an Agent to obtain a target website URL and goal, then substitute those values into Bash command templates. The `` and `` placeholders are unquoted. Although the goal placeholder is shown inside double quotes, double quoting alone is not a safe substitution mechanism if the supplied value contains a quote, command substitution, backticks, or certain shell expansions. The guide does not require: - Invocation through a structured argument-array API. - Strict validation of URLs and site names. - Shell-safe escaping of dynamic values. - Rejection of control characters, leading options, or shell metacharacters. - Use of `--` to separate options from positional values where supported. The target URL, site name, and goal originate from the adapter request and therefore cross an untrusted-data boundary. If an Agent follows these templates using a shell and performs direct textual substitution, crafted input can alter command parsing and execute an unrelated command. The workflow's consent requirement does not eliminate this issue. Consent to create or investigate an adapter does not constitute consent to execute arbitrary commands embedded in adapter parameters. ### Attack Path 1. An attacker asks the Agent to create or investigate a custom adapter. 2. The attacker supplies a URL, goal, or site name containing shell syntax, such as command separators, command substitution, redirection, or a newline. 3. The Agent substitutes the supplied value into one of the documented Bash templates. 4. The Agent invokes the resulting command through a shell. 5. The shell in ...[truncated 1270 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (17)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: 技能在失败处理里建议直接运行 opencli doctor，但同一文档前文已说明某些流程会读取浏览器桥接状态、登录态页面数据或请求流量，且此类操作应先告知影响范围并获得同意。缺少就近警示和显式确认，可能导致代理在未充分告知用户的情况下访问浏览器/登录态相关信息，造成隐私暴露或超出用户预期的数据访问。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The instruction explicitly requires results to be reported in Simplified Chinese. This is a natural-language locale policy constraint that forces a specific language without any user opt-in or alternative language path.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · guides/custom-adapters-reference.md (reported line 52)May include surrounding context.
${{ item.score > 10 }} ${{ item.active ? 'yes' : 'no' }} ${{ item.title | truncate(30) }} https://api.com/${{ item.id }}.json ${{ item.subtitle || 'N/A' }} ${{ Math.min(args.limit, 50) }}

text

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The guide documents persisted outputs under ~/.opencli/explore/ and ~/.opencli/record/ and notes that custom adapters require permission before persistent writes, but it does not similarly warn that explore/record artifacts may contain sensitive browsing, session-derived, or captured data. In a skill centered on browser interception, recording, and adapter debugging, silent persistence materially increases privacy and data-retention risk if operators use these features without informed consent or cleanup expectations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The document is written entirely in Chinese and directly instructs the agent on when and how to use the skill, but it does not provide any opt-in, alternative language path, or justification that the skill is region-specific. Under the policy, forcing a specific language or locale without user choice is a natural-language policy violation.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · guides/custom-adapters.md (reported line 92)May include surrounding context.
md
columns: [rank, title, score] pipeline: - fetch: https://api.mysite.com/hot - select: data.posts - map: rank: "${{ index + 1 }}"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · guides/custom-adapters.md (reported line 117)May include surrounding context.
md
columns: [rank, title, score] pipeline: - fetch: https://api.mysite.com/hot - select: data.posts - map: rank: "${{ index + 1 }}"

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The manifest describes using opencli to access supported websites, desktop apps, and external CLIs, but this fallback guide specifically normalizes passthrough to arbitrary external tools like gh, docker, and kubectl. Those capabilities can be much broader and more privileged than the browsing/searching/timeline/bookmark/notification/home/trending/article/history tasks emphasized in the skill description, making them unjustified in this skill-level guidance without tighter scoping.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file contains instructional content only in Chinese, which effectively forces a specific language for users of the skill. The policy allows locale constraints only when the skill offers opt-in or clearly documents a justified region/language limitation, neither of which appears here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This markdown file contains user-facing instructions and descriptions only in Chinese, such as section headings and operational notes. Under the policy rule, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is documented and justified, which is not present here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This markdown file presents headings and explanatory text in Chinese, which effectively forces a specific language for users reading the skill reference. The policy allows locale constraints only when the skill offers user choice or clearly documents a justified region-specific limitation, neither of which appears here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The instructional content and headings are written entirely in Chinese, which imposes a specific language on users without any opt-in or alternative. The file does not indicate that the skill is region-specific or otherwise justified to require Chinese, so this is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This markdown file contains user-facing instructions and warnings entirely in Chinese, with no indication that users can choose another language. That can violate a language/locale policy when the skill implicitly forces a specific language without explicit opt-in or justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: SQP-3 applies to all file types and covers language or locale policy violations. This guide consistently forces one language for all instructions and warnings, with no opt-in, alternative language, or stated region-specific justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The markdown content presents all usage guidance and warnings in Chinese only, with no indication that users can select another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This markdown file presents all user-facing instructions and descriptions only in Chinese, with no indication that the user can choose another language. That can violate a language/locale policy when users are not explicitly opted into Chinese-only content.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This markdown file is entirely written in Chinese and does not indicate that the skill is region-specific or provide any user opt-in for language preference. Under the policy, forcing a specific language without user choice can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.