opencli

Universal CLI for browser automation and website command-line access, supporting commands for Bilibili, Twitter, Reddit, GitHub, and more with automation fea...

Security Scan

The skill's description (browser automation, accessing logged-in sites) is plausible, but the instructions imply access to sensitive browser sessions, a background daemon, and automatic installation of external CLIs while the skill bundle provides no install, provenance, or declared credential requirements — these mismatches warrant caution.

Purpose & Capability

The stated purpose (CLI for browser automation and site-specific commands) aligns with the instructions, but the SKILL.md asserts an installed binary path (/Users/c/.openclaw/opencli) and a daemon without providing an install spec or any provenance. That is an inconsistency: an instruction-only skill claims an installed artifact it does not itself provide.

Instruction Scope

Runtime instructions refer to 'cookie/intercept mode' and require Chrome to be logged in to access user-specific pages. That implies the agent will need to read or connect to the user's browser session (cookies, profile, or debugging port). The doc also says opencli will 'automatically try to install' missing external CLIs — giving the agent permission to execute installers or download tools. Both raise data-exfiltration and arbitrary-execution risks not constrained by the SKILL.md.

Install Mechanism

There is no install spec in the skill (instruction-only), so the skill itself writes nothing. However, the instructions rely on a preinstalled binary and describe auto-install behavior for external CLIs; those runtime installs (performed by the opencli binary or by the agent invoking installers) are outside the skill package and could fetch arbitrary code. The skill provides no trusted URLs, checksums, or guidance on what gets installed.

Credentials

The skill declares no required env vars or creds, yet its functionality depends on access to logged-in browser state (cookies/session). Access to Chrome profile data or enabling a remote debugging port is sensitive and not declared. The automatic installation of other CLIs could also demand elevated privileges or network access that the skill does not enumerate.

Persistence & Privilege

always:false and model invocation are normal. The SKILL.md references a daemon and an installed path, implying a background component and persistent installation, but the skill package has no install or persistence declarations. This mismatch is suspicious but not proof of malicious intent.

What to consider before installing

This skill behaves like a thin wrapper around a separate, preinstalled 'opencli' binary and expects access to your Chrome session and to install external CLIs on demand. Before installing or enabling it: (1) verify the provenance of the opencli binary (source URL, maintainers, and checksums); (2) avoid granting access to your browser profile/cookies unless you fully trust the binary—consider using an isolated browser profile or VM; (3) refuse or inspect any automatic installer runs (know what URLs/executables will be fetched); (4) demand explicit install instructions or source code/homepage from the publisher; and (5) if you need the functionality but want lower risk, run opencli inside a sandboxed container with no access to your main Chrome profile. Providing the skill's source, release URLs, and checksum would raise confidence; lacking that, treat it with caution.

OpenCLI — Universal CLI Hub & Browser Automation

opencli 已安装于 /Users/c/.openclaw/opencli，可通过 opencli 命令直接调用。

快速检查

opencli --version      # 验证安装
opencli list           # 列出所有可用命令
opencli doctor         # 检查扩展 + daemon 连接状态

核心命令分类

公开 API（无需登录）

站点	示例命令
新闻	opencli bbc news, opencli 36kr news
搜索	opencli bilibili search "关键词", opencli hackernews search "关键词"
榜单	opencli bilibili hot, opencli bilibili ranking
论文	opencli arxiv search "关键词", opencli arxiv paper <id>
GitHub	opencli github trending

需要登录的命令（cookie/intercept 模式）

需要 Chrome 已登录目标网站。常用：

• opencli bilibili favorite — 我的收藏夹
• opencli bilibili history — 观看历史
• opencli bilibili feed — 关注动态
• opencli twitter timeline — Twitter 时间线
• opencli reddit frontpage — Reddit 首页

浏览器自动化（operate 命令）

opencli operate open <url>           # 打开网页
opencli operate state                # 查看页面元素（带索引）
opencli operate click <N>           # 点击元素
opencli operate type <N> "文本"      # 输入文本
opencli operate screenshot          # 截图
opencli operate get value <N>        # 获取输入框值
opencli operate scroll <N>           # 滚动
opencli operate back                 # 返回
opencli operate wait time <秒>       # 等待

外部 CLI Hub（自动安装）

opencli gh pr list --limit 5        # GitHub CLI
opencli docker ps                    # Docker
opencli obsidian search "关键词"     # Obsidian

执行规则

1. 公开命令直接执行：opencli <site> <command> [args]
2. 需要登录的命令先检查：确保 Chrome 已登录目标网站
3. operate 命令链式调用：用 && 合并多个操作减少往返
4. 自动安装：如果外部 CLI 不存在，opencli 会自动尝试安装

输出格式

opencli 输出为结构化文本，直接可读。JSON 格式可通过 opencli ... --json 获取（部分命令支持）。

常用命令参考

# B站
opencli bilibili hot --limit 5
opencli bilibili search "关键词" --limit 10
opencli bilibili user-videos <uid>

# Twitter/X
opencli twitter trending
opencli twitter search "关键词" --limit 10

# Reddit
opencli reddit hot
opencli reddit frontpage

# GitHub
opencli github trending

# 新闻
opencli bbc news
opencli 36kr news
opencli hackernews top --limit 5

# 论文
opencli arxiv search "LLM" --limit 5