opencli

Universal CLI for browser automation and website command-line access, supporting commands for Bilibili, Twitter, Reddit, GitHub, and more with automation fea...

This skill behaves like a thin wrapper around a separate, preinstalled 'opencli' binary and expects access to your Chrome session and to install external CLIs on demand. Before installing or enabling it: (1) verify the provenance of the opencli binary (source URL, maintainers, and checksums); (2) avoid granting access to your browser profile/cookies unless you fully trust the binary—consider using an isolated browser profile or VM; (3) refuse or inspect any automatic installer runs (know what URLs/executables will be fetched); (4) demand explicit install instructions or source code/homepage from the publisher; and (5) if you need the functionality but want lower risk, run opencli inside a sandboxed container with no access to your main Chrome profile. Providing the skill's source, release URLs, and checksum would raise confidence; lacking that, treat it with caution.

Type: OpenClaw Skill Name: opencli-hub Version: 1.0.0 The skill bundle provides a CLI interface ('opencli') for browser automation and interaction with authenticated web accounts (Twitter, Bilibili, Reddit), which inherently involves high-risk access to user session data. Significant red flags include a hardcoded local path ('/Users/c/.openclaw/opencli') in SKILL.md and the claim that the tool 'automatically' installs external CLI binaries (e.g., Docker, GitHub CLI), which presents a potential supply chain or remote code execution risk. While no explicit exfiltration logic is visible in the provided markdown, the combination of broad system access and automated binary installation is highly risky.