opencli

Use opencli CLI to interact with social/content websites (Bilibili, Zhihu, Twitter/X, YouTube, Weibo, 小红书, V2EX, Reddit, HackerNews, 雪球, BOSS直聘 etc.) via the...

Security Scan

The skill's stated purpose (wrapping opencli to reuse your Chrome login and interact with many sites) is coherent, but the SKILL.md asks you to install an npm CLI, a browser extension, and an npx MCP bridge—none of which are declared in the skill metadata—and the runtime instructions permit reading private pages and writing local CLI YAMLs and controlling your browser, which raises privacy and installation-risk concerns the user should understand before installing.

Purpose & Capability

The name/description match the instructions: it intends to reuse your Chrome login to interact with many social sites via the opencli CLI and fall back to Playwright for unsupported cases. However, the skill metadata declares no required binaries or installs, while SKILL.md explicitly expects Node.js, the @jackwener/opencli npm package, and Playwright MCP — an inconsistency in declared vs. actual prerequisites.

Instruction Scope

Runtime instructions direct the agent to reuse Chrome login sessions, read private pages (messages/notifications), perform write actions (post/reply/like) with Playwright fallback, and create files under ~/.opencli/clis/<site>/top.yaml. The fallback rule 'ALWAYS prefer opencli; if not, automatically switch to Playwright' is broad and could cause the agent to access private content or control the browser without sufficiently explicit user consent in all cases.

Install Mechanism

There is no formal install spec in the registry, but README/SKILL.md instruct manual installs via 'npm install -g @jackwener/opencli', 'npx @playwright/mcp@latest', and installing a Chrome extension from the Web Store. Using npx executes remote code at runtime and installing a browser extension that acts as a bridge to the user's logged-in sessions increases risk if the extension or npm package are untrusted or impersonated. Verify sources and package maintainer before running.

Credentials

The skill declares no required environment variables or credentials, but functionally requires access to your Chrome browser login sessions (via an extension/bridge) and will read/write files in the user's home (~/.opencli). Access to browser sessions is effectively access to account cookies and can expose private data; this is proportionate to the stated purpose but sensitive and not reflected in metadata.

Persistence & Privilege

The skill is not always-enabled and is user-invocable (normal). However, configuring Playwright MCP and installing the browser extension gives the agent a live capability to control the browser (read pages, click, type). That increases the blast radius if the agent is allowed to invoke skills autonomously — worth explicit user caution though not a metadata-level misconfiguration here.

What to consider before installing

Before installing or running this skill: 1) Verify the opencli npm package and the GitHub repo linked in the README are the legitimate upstream project and maintained by a trusted author. 2) Review the Playwright MCP Bridge extension on the Chrome Web Store (permissions, publisher) before installing — the extension bridges the agent to your browser and can expose logged-in sessions. 3) Understand that the skill will read private pages (messages/notifications) and write local config files (~/.opencli/clis/...), so consider using a separate browser profile for sites you don't want exposed. 4) Be cautious running 'npx' commands or globally installing npm packages — these execute remote code; prefer auditing packages or installing from pinned releases. 5) Confirm the agent will always show you the content before performing write operations (the README says it will, but verify at runtime). If you cannot or do not want automated access to your logged-in accounts or private messages, do not install or enable the Playwright bridge/extension and run opencli only in a controlled environment.

CLI tool that turns websites into CLI interfaces, reusing Chrome's login state. Zero credentials needed.

Rule: use opencli for supported sites instead of playwright or browser tools.

Syntax

opencli <site> <command> [--option value] [-f json]

Common flags (all commands):

• -f json — machine-readable output (preferred for parsing)
• --limit N — number of results (default varies, usually 20)
• -f table|json|yaml|md|csv

Quick Examples

# 读取/浏览
opencli bilibili hot --limit 10 -f json
opencli zhihu hot -f json
opencli weibo hot -f json
opencli twitter timeline -f json
opencli hackernews top --limit 20 -f json
opencli v2ex hot -f json
opencli reddit hot -f json
opencli xiaohongshu feed -f json

# 搜索
opencli bilibili search --keyword "AI" -f json
opencli zhihu search --keyword "大模型" -f json
opencli twitter search --query "claude AI" -f json
opencli youtube search --query "LLM tutorial" -f json
opencli boss search --query "AI工程师" --city "上海" -f json

# 互动（写操作）
opencli twitter post --text "Hello from CLI!"
opencli twitter reply --url "https://x.com/.../status/123" --text "Great post!"
opencli twitter like --url "https://x.com/.../status/123"

# 个人数据
opencli bilibili history -f json
opencli twitter bookmarks -f json
opencli xueqiu watchlist -f json

Output Formatting Rules

When displaying results to the user:

1. Always show original title + Chinese translation + clickable link as separate columns
2. Table format: # | 原标题 | 中文翻译 | 链接 | 关键指标...
3. 原标题: plain text, no markdown link — do NOT use [title](url) format
4. 中文翻译: plain Chinese translation text
5. 链接: [🔗](url) — compact clickable icon
6. Translate all English titles to Chinese — never show English-only output to the user

Example:

| # | 原标题 | 中文翻译 | 链接 | 分 | 评论 |
|---|--------|---------|------|-----|------|
| 1 | The 49MB web page | 那个 49MB 的网页 | [🔗](https://...) | 388 | 196 |

Fallback 策略：opencli 不支持时用 Playwright

核心原则：永远不说"不支持"，先尝试 opencli，失败或无命令时自动切换 Playwright。

决策流程

用户请求
  ↓
opencli 有对应命令？
  ├─ 是 → 执行 opencli
  └─ 否 → 直接用 Playwright MCP 打开对应页面完成任务
              ↓
           Playwright 报错 / 无法连接？
              └─ 引导用户安装桥接插件（见下方）

常见 opencli 不支持场景 → Playwright 替代

场景	网址	Playwright 操作
知乎私信	https://www.zhihu.com/messages	navigate → snapshot 读取列表
知乎通知	https://www.zhihu.com/notifications	navigate → snapshot
微博发帖	https://weibo.com	navigate → 点击输入框 → type → 发送
小红书私信	https://www.xiaohongshu.com/im	navigate → snapshot
B站私信	https://message.bilibili.com	navigate → snapshot
Twitter DM	https://x.com/messages	navigate → snapshot

Playwright 操作标准流程

1. mcp__playwright__browser_navigate → 目标 URL
2. mcp__playwright__browser_snapshot → 读取页面结构
3. 根据需要：browser_click / browser_type / browser_scroll
4. 将结果整理后呈现给用户

⚠️ 写操作风险提示（发帖/回复/点赞前必须告知）

1. 账号安全：自动化行为可能触发平台风控
2. 不可撤回：发布后立即公开
3. 最佳实践：执行前向用户展示将发布的内容，等待确认

插件未安装时的引导话术

如果 Playwright 报错（连接失败 / 无法控制浏览器），告知用户：

"需要在 Chrome 安装 Playwright MCP Bridge 插件才能控制浏览器。 安装步骤：

1. 打开 Chrome，访问 Chrome Web Store
2. 搜索 "Playwright MCP" 或 "MCP Bridge"
3. 点击「添加到 Chrome」
4. 安装后确保 Chrome 已登录目标网站
5. 重新告诉我你的需求，我来帮你完成"

Requirements

• Chrome browser open with target site logged in
• Playwright MCP Bridge extension installed in Chrome（未安装时见上方引导）

自迭代能力：为新网站创建 CLI

当 opencli 不支持某个网站时，不要放弃——自己创建！

流程

1. opencli <site> --help  →  报错？说明不支持
2. opencli generate <url>  →  尝试自动生成（成功则结束）
3. 自动生成失败 → 手动创建 YAML：
   a. 用 Playwright 打开目标页面
   b. browser_evaluate 探索 DOM 结构（找 data-test 属性、class 规律）
   c. 确认选择器后写入 ~/.opencli/clis/<site>/top.yaml
   d. opencli <site> top -f json  →  验证输出

YAML 格式（DOM 抓取模板）

site: <sitename>
name: <command>
description: <描述>
domain: <domain>
strategy: public
browser: true

args:
  limit:
    type: int
    default: 10

pipeline:
  - navigate: https://<url>
  - evaluate: |
      (async () => {
        const limit = ${{ args.limit }};
        // DOM 抓取逻辑
        return results;
      })()

columns: [rank, name, ...]

已创建的自定义 CLI

站点	命令	文件	关键选择器
producthunt	top	~/.opencli/clis/producthunt/top.yaml	button[data-test="vote-button"] → 父容器 → [data-test^="post-name-"]，tagline: nameEl.parentElement.querySelector('span.mt-0\\.5')

调试技巧

• browser_evaluate 先探结构：document.querySelector('...').innerHTML
• 找 data-test 属性最稳定，其次 class 中的语义词
• tagline 通常是 name 的兄弟元素（nameEl.parentElement.querySelector('span...')）
• 去重用 seen = new Set()，防止重复产品

Full Command Reference

See references/commands.md for all 55 commands with complete argument details.