OpenCLI Tool Integration

使用 OpenCLI 工具从各种网站和桌面应用获取数据、下载媒体内容、控制外部 CLI 工具。支持 Bilibili、知乎、小红书、Twitter/X、Reddit、YouTube、Boss直聘、即刻、微博等 30+ 平台，以及 Cursor、Codex、ChatGPT、Notion 等桌面应用。当用户需要：从社...

This skill appears to be what it says, but pay attention to a few important points before installing: - Manifest mismatch: the registry metadata claims no required binaries/env, yet SKILL.md requires Node >= 20, Chrome running, a Browser Bridge extension, and optionally yt-dlp and other CLIs. Treat the listed install steps as mandatory. - Sensitive local access: the tool reuses Chrome login sessions and talks to a local daemon (localhost:19825). That means the installed extension/daemon can access cookies, logged-in accounts, and local app state. Only proceed if you trust the package and extension. - Third-party code risk: you must run `npm install -g @jackwener/opencli` and install an extension downloaded from GitHub Releases (and enable developer mode). Review the GitHub repo and NPM package owner, read the extension code or releases, and prefer official/reputable sources. - Limit exposure: consider using a dedicated browser profile or secondary OS user for scraping tasks, avoid using sensitive accounts when the extension has access, and inspect network activity if possible. - If you need higher assurance: review the opencli source code (repo and npm package), verify the Browser Bridge release checksum, and check what data the extension/daemon sends over the network. Given the metadata omissions and the sensitive nature of browser session reuse, proceed with caution; if you cannot audit the external package and extension, consider alternatives or limit the accounts used with this tool.

Type: OpenClaw Skill Name: opencli-tool Version: 1.0.0 The skill integrates the 'opencli' tool, which provides an AI agent with high-privilege access to logged-in browser sessions (via a custom Chrome extension), desktop applications (Cursor, Notion, Discord), and system-level CLI tools (Docker, Kubectl). While these capabilities are aligned with the tool's stated purpose of automation and data extraction, the broad access to sensitive personal data, session cookies, and local system commands represents a significant security risk. The skill encourages the installation of a global NPM package (@jackwener/opencli) and a manual Chrome extension to facilitate this access, as detailed in SKILL.md.