OpenCLI Universal CLI Hub

OpenCLI — 通用 CLI Hub，将任何网站、Electron 应用或本地工具转化为命令行接口。66+ 内置命令，支持 Bilibili/Twitter/Reddit/Xiaohongshu/GitHub 等。复用 Chrome 登录态，零 LLM 成本，确定性输出。

This skill is coherent with its purpose but uses sensitive capabilities. Before installing: (1) review the npm package source code and author (@jackwener) and prefer reproducible release artifacts or pinned versions; (2) verify the Browser Bridge extension release artifacts (release URL, checksums) and inspect requested extension permissions; (3) consider running the CLI and extension inside an isolated environment (VM/container) or test account, not against your primary Chrome profile or important accounts; (4) confirm what the local daemon exposes (which endpoints, whether it listens only on localhost, and whether it accepts remote requests); (5) avoid granting it access to accounts with high privileges until you can audit network traffic and code; (6) if you need to proceed, track how to uninstall the npm package and remove the extension/daemon. These steps reduce risk of credentials or sensitive browsing data being exfiltrated.

Type: OpenClaw Skill Name: opencli-yuzengbao Version: 1.0.0 The opencli skill installs a global NPM package (@jackwener/opencli) and requires the manual installation of a 'Browser Bridge' Chrome extension from a ZIP file to 'reuse Chrome login state.' This architecture is designed to allow CLI access to authenticated web sessions (Bilibili, Twitter, GitHub, etc.), which is a high-risk capability that could be used for data exfiltration. While the documentation in SKILL.md describes it as a productivity tool for API discovery and CLI automation, the requirement to bypass the Chrome Web Store and the inherent access to sensitive session data via a local daemon (localhost:19825) warrant a suspicious classification.