Security audit

opencli-agent

Security checks for vulnerabilities and agentic risk

Overview

The skill is a broadly scoped OpenCLI automation wrapper that can act through logged-in browser sessions, install unpinned tools/plugins, and control local apps without enough scoping or confirmation guidance.

Review before installing. Use a dedicated Chrome profile, avoid primary logged-in sessions, pin and verify the npm package and extension source, and require manual approval before any post, delete, follow, block, message, plugin install, package install, or local CLI command.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Error

Location: SKILL.md:22
Finding: Unpinned Global CLI and Sideloaded Browser Extension
Content: View full analysis
= 20.0.0): `brew install node` 或访问 https://nodejs.org 2. **安装 OpenCLI**: `npm install -g @jackwener/opencli` 3. **安装浏览器扩展**: - 从 https://github.com/jackwener/opencli/releases 下载 `opencli-extension.zip` - 打开 Chrome → `chrome://extensions` → 开启"开发者模式" - 点击"加载已解压的扩展程序" → 选择解压后的文件夹 4. **登录目标网站**：在 Chrome 中登录目标网站（例如：发推前先在 Chrome 中登录 twitter.com） 5. **验证**：运行 `opencli doctor` 确认扩展和守护进程连接正常 ``` ### Technical Analysis The Skill instructs users to install `@jackwener/opencli` globally without pinning a reviewed version. It also directs users to download and sideload an unpacked browser extension from a mutable GitHub release location without a checksum, digital signature, release tag, or other integrity verification. GitHub is a conventional code-hosting service rather than a pastebin, and the repository owner matches the npm package namespace. Nevertheless, both installation channels deliver mutable third-party executable code. A global npm installation can run package lifecycle scripts with the installing user's privileges. A sideloaded Chrome extension can receive significant browser permissions and operate in a browser containing authenticated sessions. Reusing authenticated Chrome sessions is relevant to the declared website-automation functionality. However, requiring an unverified, unpacked extension and globally installed package exceeds a safe minimum-trust design because the Skill does not constrain versions, verify provenance, or disclose and limit extension permissions. ### Attack Path 1. An attacker compromises the npm package, maintainer account, GitHub repository, release workflow, or downloadable release archive. 2. The attacker publishes a malicious p ...[truncated 1255 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: references/command_reference.md:9
Finding: Arbitrary Community Plugin Installation and Implicit External CLI Installation
Content: View full analysis
--site ` | Auto-analyze a website's API and auth strategy | | `opencli synthesize ` | Auto-generate adapter code for a site | | `opencli register ` | Register a local CLI tool | | `opencli plugin install github:user/repo` | Install a community plugin | ``` ```markdown ## External CLI Hub OpenCLI can proxy any locally installed CLI. If the tool is not installed, it auto-installs via the system package manager. | Command | Description | |---------|-------------| | `opencli gh ` | GitHub CLI | | `opencli docker ` | Docker CLI | | `opencli obsidian ` | Obsidian CLI | | `opencli vercel ` | Vercel CLI | ``` ```markdown ### 外部 CLI 集线器 OpenCLI 可以代理并自动安装外部 CLI 工具： # 如果 gh 未安装，会自动安装后再执行命令 opencli gh pr list --limit 5 opencli docker ps ``` ### Technical Analysis The documented interface allows installation of a community plugin from a user-controlled GitHub repository. No source allowlist, commit pin, version constraint, signature check, integrity hash, review process, or sandbox requirement is specified. The external CLI hub can also install missing tools automatically through the system package manager. This creates an implicit state-changing installation step behind a command that may appear to be an ordinary CLI invocation. Automatic installation is not necessary when the intended operation can instead fail safely and ask the user to review and install the dependency. The `synthesize` and `register` capabilities further expand the executable trust boundary by generating adapter code and registering local tools. These functions a ...[truncated 1941 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (15)

Exfiltration Commands

High

Category: Prompt Injection
Confidence: 90% confidence
Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.
Content: Scanner excerpt · Opencli skill/.codebuddy/skills/opencli-agent/references/command_reference.md (reported line 144)May include surrounding context.
md
| Command | Arguments | Description | |---------|-----------|-------------| | `opencli cursor chat` | `"<message>"` | Send message in Cursor IDE | | `opencli chatgpt send` | `"<message>"` | Send message to ChatGPT desktop | | `opencli notion search` | `"<keyword>"` | Search in Notion | | `opencli discord-app send` | `"<message>"` | Send message in Discord |

Concealed Executable Artifact

High

Category: Supply Chain
Confidence: 100% confidence
Finding: An executable nested in a document or hidden/disguised artifact can evade ordinary extension-based review while still being available to the skill at runtime.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: 声明描述的是一个面向终端用户的网络服务自动化技能，核心能力应是操作 Twitter/X、Reddit、B站、小红书等平台。给出的代码却并未实现任何此类站点交互、发帖、搜索、抓取或下载逻辑，而只是一个安装与环境健康检查脚本。虽然这些检查可被视为 opencli 的配套支持步骤，但该代码块本身的主要用途与声明的主要用途不同：它关注本地运行环境验证，而不是执行所宣称的跨平台自动化任务。因此应判定为描述与代码行为不匹配。
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger conditions are extremely broad, covering effectively any command-line automation involving websites or online services. Overbroad routing can cause the skill to activate unexpectedly for unrelated requests, increasing the chance of unsafe command generation or execution in contexts where the user did not intend to grant such operational authority.
Content: No source excerpt is available for this finding.

Exfiltration Commands

High

Category: Prompt Injection
Confidence: 90% confidence
Finding: The documented ability to send messages into ChatGPT desktop, Cursor, and Discord creates an exfiltration pathway because an agent could relay sensitive local or conversation-derived information into third-party applications. In the context of a broadly scoped automation skill, this is more dangerous because the same interface also reaches many services and local tools, increasing opportunities for covert data transfer.
Content: Scanner excerpt · references/command_reference.md (reported line 144)May include surrounding context.
md
| Command | Arguments | Description | |---------|-----------|-------------| | `opencli cursor chat` | `"<message>"` | Send message in Cursor IDE | | `opencli chatgpt send` | `"<message>"` | Send message to ChatGPT desktop | | `opencli notion search` | `"<keyword>"` | Search in Notion | | `opencli discord-app send` | `"<message>"` | Send message in Discord |

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Automatically installing missing tools via the system package manager is a direct system-modification capability that is unjustified by the stated purpose of interacting with websites and online services. In an agent workflow, this can silently change the host environment, pull and execute new software, and create a path from benign-seeming requests to arbitrary code execution or persistence.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: L003 的描述全文为中文，且文件整体以中文指令为主，但未说明这是可选语言，也未向用户提供语言/locale 选择。根据该规则，若技能隐含强制特定语言而没有用户选择或合理的地区限定说明，应视为自然语言政策问题。
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation includes destructive and side-effecting operations such as posting, liking, following, deleting content, and auto-installing external CLI tools, but does not require explicit confirmation or warn sufficiently about account, privacy, and system risks. In this context, the skill reuses existing browser sessions, so unintended execution could directly act on authenticated accounts and modify user state immediately.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill expands from website automation into local desktop app control and arbitrary external CLI proxying, including automatic installation of missing tools. That creates a much broader execution surface than users would expect, enabling local actions and supply-chain exposure through unreviewed package installation or command forwarding.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Plugin installation and local CLI registration introduce code-extension and execution pathways not described in the skill metadata, creating hidden capability expansion. In a security review context, undocumented extensibility is dangerous because an agent or user may trust the skill for simple website automation while it can instead add or bridge arbitrary tools.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The documentation includes account-affecting actions such as posting, replying, deleting, following, blocking, and DM-related operations without prominent warning that they modify user accounts or communicate externally. In an agentic environment, omission of such warnings increases the likelihood of accidental destructive or reputation-impacting actions under ambiguous prompts.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Desktop application control through CDP extends the skill from web-service automation to interactive control of local applications such as Cursor, ChatGPT desktop, Notion, and Discord. This creates a cross-application injection channel where the agent can send content into sensitive apps, potentially exposing data or triggering unintended actions outside the declared skill scope.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Desktop app control commands are presented without warning that they can inject messages or queries into other applications, some of which may contain confidential information or trigger downstream actions. Because these are local-app interactions rather than simple data retrieval, the absence of warnings materially increases the risk of prompt injection, data leakage, or unintended cross-tool actions.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The reference expands the skill from web-service automation into a generic local CLI proxy capable of invoking tools like docker, gh, and vercel, which materially broadens the accessible attack surface. In an agent setting, this can enable unintended local command execution and system interaction well beyond the user-facing skill description, undermining scope-based trust and consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documented auto-install behavior modifies the system by invoking the package manager, yet no warning is provided about software installation or environment changes. Users may reasonably interpret the skill as a network-service automation tool, not one that can alter their machine, making the omission security-significant.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.