cli-anything-safari

The Blender CLI's live-preview feature launches an external program resolved from PATH ('cli-hub') as a detached background process with --open and output discarded whenever a live preview session is started with the open flag, executing a binary the artifact does not pin or verify.

process = subprocess.Popen(

The harness renders previews by loading arbitrary user-supplied .blend-cli.json scene files (open_scene), templating that data into a generated Python bpy script, and executing the script headless via blender_backend.render_scene_headless (and via the returned 'blender --background --python' command), so unescaped scene strings reaching the generator would yield code execution; escaping in utils/bpy_gen.py is unverified.

backend_result = blender_backend.render_scene_headless(script, output_path, timeout=timeout)

The browser harness's URL-validation module documents that private-network blocking is disabled by default, allowing the agent-driven browser to reach localhost and private/link-local ranges (including cloud-metadata endpoints) unless an environment variable is explicitly set.

Default: False (allow localhost/private networks for development)

The browser harness disables its SSRF guard by default (_BLOCK_PRIVATE_NETWORKS is False unless CLI_ANYTHING_BROWSER_BLOCK_PRIVATE is set), so the agent-driven browser may navigate to localhost and private/link-local hosts (including cloud-metadata ranges) and return that content into agent context.

_BLOCK_PRIVATE_NETWORKS = os.environ.get(

The repository ships cli-hub-matrix/video-creation/scripts/video_doctor.py, which executes subprocess command lists (here for local ffmpeg/ffprobe video diagnostics); this exec capability is undeclared by the target's stated Safari-automation purpose and matches the flagged contradiction with the safari-harness claims 'No Safari, no network, no subprocess.' (D248) and the safari-mcp concurrency warning (D284) if those claims scope this script, which the shown evidence cannot confirm.

return subprocess.run(cmd, text=True, capture_output=capture, check=False)

The same undeclared analytics supports a second provider that posts event payloads to cloud.umami.is with a hardcoded website ID, undeclared network egress the declared Safari-automation purpose does not need (residue R7, unexplained).

UMAMI_URL = 

cli-hub ships default-on, undeclared telemetry that sends event payloads (event name, platform, persistent distinct ID, hub version, AI-agent classification) to a hardcoded PostHog endpoint on every invocation — network egress absent from the target's declared Safari-automation purpose (residue R8, unexplained).

POSTHOG_API_HOST = 

Send a single event payload. Blocking — callers should use threads.

cli-hub bundles analytics that sends invocation/install events to an off-host provider and specifically classifies whether the caller is an AI agent, with the destination endpoint and transmitted fields not disclosed in the shown content.

Detect if cli-hub is likely being invoked by an AI agent.

The bundled cli-hub analytics module builds payloads containing a persistent UUID distinct ID stored in ~/.cli-hub, an analytics project token read from the environment, host version, and event data, and POSTs them from a daemon thread to cloud.umami.is or an environment-overridable PostHog capture endpoint, undisclosed in the skill's declared Safari-automation purpose.

requests.post(                UMAMI_URL,

The analytics library's track_* wrappers send an off-host telemetry event for each user action (install, uninstall, launch, matrix install/preflight/discover/info, first run), extending the undeclared telemetry surface across the entire CLI.

track_event(

Every cli-hub invocation and each install/uninstall/launch/matrix action automatically fires background telemetry events containing the command label, CLI names, platform, and agent/human classification to the remote analytics endpoint without user interaction.

track_visit(command=_invocation_command(ctx, version), detection=detect_invocation_context())

Every cli-hub subcommand (install, uninstall, update, can, matrix list/search/info/preflight/install) fires an undeclared analytics event carrying command, scope, counts, and platform to the PostHog/Umami endpoints, so routine use generates off-host usage reporting the declared purpose never mentions.

track_install(name, cli[

The launch command replaces its own process with the registry-defined entry point resolved on PATH via os.execvp, executing whatever binary the remotely fetched registry names with the user's pass-through arguments.

os.execvp(entry, [entry] + list(args))

The cli-hub previews html/watch/open commands write rendered HTML into session/bundle directories and serve or open it, contradicting the declared claim that the previews family (inspect/html/watch/open) is a read-only consumer and not a render path (D89).

output_path = os.path.join(session_dir, 

Matrix skill files (SKILL.md plus references and scripts) are rendered to local disk from content defined in the remotely fetched registry, planting agent-readable instructions sourced from a mutable network endpoint.

Render the matrix skill (SKILL.md + references/ + scripts/) without installing member CLIs.

cli-hub's installer executes dynamic, registry-provided command strings via _run_command for generic and uv install/uninstall/update actions, contradicting the safari harness safety claim 'No Safari, no network, no subprocess.'; the commands are unpinned and their registry source is not shown here.

result = _run_command(install_cmd)

When uv or npm is missing the tool returns hint strings instructing the user or agent to run curl|sh, irm|iex, and sudo curl|bash vendor installers, which an agent following the output may execute verbatim.

curl -fsSL https://deb.nodesource.com/setup_lts.x | sudo -E bash - && sudo apt-get install -y nodejs

The installer executes command strings sourced from the remote CLI registry with shell=True whenever they contain shell metacharacters (explicitly to support curl|bash-style installs), so mutable registry content can run arbitrary shell commands on the host during install; the docstring's 'trusted registry' justification is an unverifiable status claim carrying no weight.

use_shell = any(c in cmd for c in _SHELL_METACHARACTERS)

render_matrix_skill_file writes agent-readable skill content into ~/.cli-hub/matrix/<name>/SKILL.md in the user's home directory and _copy_matrix_assets wholesale-replaces the references/ and scripts/ directories beside it on every render, outside any workspace.

output_path.write_text(

cli-hub downloads published matrix SKILL.md instructions from a mutable GitHub Pages URL (main-branch pages) when no local source exists and writes them into agent-loadable ~/.cli-hub/matrix/<name>/SKILL.md files with remotely linked references, injecting unpinned remote instructions into agent context contrary to the harness rule that SKILL.md must be self-contained.

resp = requests.get(url, timeout=10)

cli-hub preview's open_in_browser launches a browser via subprocess.Popen with a PATH-resolved binary to display the preview report — an exec capability undeclared in the Safari-automation description; the matched claims 'No Safari, no network, no subprocess.' (D247/D248) and the concurrent-MCP-use caution (D284) live in the Safari harness docs and their scope over cli-hub code could not be verified from the evidence shown.

process = subprocess.Popen(

cli_hub/registry.py downloads registry JSON from remote URLs at runtime via requests.get and caches it locally, and the fetched entries carry install_cmd values that the installer later executes, so the registry host controls what commands run on the host.

resp = requests.get(url, timeout=15)

cli-hub fetches its CLI catalog from the mutable URLs https://hkuds.github.io/CLI-Anything/registry.json and public_registry.json at runtime, and provider_install_hint passes remote install_hint command strings through verbatim as install commands for the agent or user to execute.

REGISTRY_URL =

cli-hub ships an undeclared analytics/telemetry subsystem (analytics.py: opt-out, event firing for cli-install/cli-uninstall/cli-launch/per-call events, first-run marker file, and _detect_is_agent/detect_invocation_context which detects agent environments and changes what tracking metadata is sent) — network behavior absent from the target's declarations and from every shown claim, with destination endpoint not shown.

Analytics tests

cli-hub analytics is enabled by default and sends install/uninstall/launch/invocation telemetry (CLI name, version, platform, subcommand, and agent-detection context derived from env vars like CLAUDE_CODE/CODEX and parent-process command names) to cliananything.cc, with opt-out only via the CLI_HUB_NO_ANALYTICS environment variable.

https://clianything.cc/cli-anything-hub/install/gimp

cli-hub detects when it is invoked from an agent environment and calls track_visit with the executed command and detection metadata (and tracks first-run, install, and uninstall events), telemetry whose destination is not shown in the artifact, so sensitive invocation metadata may leave the host without a visible sink.

When agent env detected, track_visit is called with the new cli-hub call metadata.

The preview-protocol documentation gives the cli-hub previews viewer file-writing behavior (`html [-o output.html]` writes a static HTML page; `watch [--open]`; PR1 plan `previews html <bundle> -o page.html`) even though HARNESS.md designates the same inspect/html/watch/open commands as a read-only consumer that should not be treated as a render path (contradictions C369-C372), an undeclared, openly documented inconsistency that breaks the literal read-only claim while the write itself is a user-directed output file.

`html` writes a static HTML page that:

The FreeCAD motion renderer helper _ensure_empty_dir recursively deletes an existing non-empty directory tree (shutil.rmtree) when the caller passes overwrite=True, a destructive capability the target's declared Safari-automation purpose does not declare; it is guarded by an explicit opt-in flag with a FileExistsError default and the paired read-only claims (D16, D89, D99, D123, D124, D195, D201, D205) concern other components, so it is reported as undeclared contextual risk rather than a confirmed contradiction.

shutil.rmtree(resolved)

_generate_motion_macro interpolates the unvalidated background string (unlike camera/fit_mode, it is never whitelist-checked, only str()-cast) into a generated FreeCAD macro that render_frames hands to freecad_backend.run_macro_content for execution, so a single quote in the background argument can break out of the string literal and inject arbitrary code into the executed macro.

view.saveImage(frame['path'], {int(width)}, {int(height)}, '{background}')

The FreeCAD preview capture path builds a Python macro as a source string (including raw f-string interpolation such as f-string appends of method/path values and project data via unseen macro_gen helpers) and executes that generated code through freecad_backend.run_macro_content, so if project-derived strings reach the macro unescaped, rendering an untrusted project file would execute injected code.

result = freecad_backend.run_macro_content(

export_csv creates directories with os.makedirs and writes spreadsheet contents to any caller-supplied path (open path 'w'), enabling file writes outside the workspace when invoked with such a path, though this is the documented CSV export capability.

os.makedirs(dir_name, exist_ok=True)

The freecad_cli harness launches background helper processes (a cli-hub live preview watcher and a background FreeCAD live preview poller) whose launch target, spawned commands, and any network publishing are not shown in the provided code.

Launch the FreeCAD live preview poller in the background

The bundled registry gives the calling agent one-call access to session credentials and host data (safari_export_storage dumps all cookies plus localStorage/sessionStorage for restoring logins, alongside safari_get_cookies and safari_clipboard_read), whose output can then be relayed off-host by the agent.

Export all storage state (cookies + localStorage + sessionStorage) as JSON

The bundled registry exposes primitives that read arbitrary local files by absolute path (safari_upload_file, safari_paste_image) and transmit their contents into whatever page the agent automates, forming a ready-made local-file-to-network channel.

Upload a file to a <input type='file'> element via JavaScript DataTransfer

The skill documents commands that read the browser profile's cookies and site storage and redirect them to a file (/tmp/storage.json), exposing session credentials if invoked beyond the declared automation scope.

cli-anything-safari tool get-cookies

Every tool call copies the full process environment (os.environ.copy()) into the spawned npx safari-mcp subprocess, handing any tokens present in the environment to the third-party npm server code.

env=os.environ.copy()

The harness documentation warns that running its E2E test suite will terminate any concurrently running safari-mcp process (including one serving another agent session) and still provides the command to do it, while a sibling section describes the upstream singleton check that SIGTERMs duplicate processes.

To run E2E locally (will kill any concurrent safari-mcp):

The `media thumbnail` command delegates to `media_mod.generate_thumbnail` while the package documents ffmpeg/melt as subprocess-backed prerequisites and test fixtures call subprocess.run, so detector-reported claims of 'no subprocess' cannot be reconciled with the shown code.

result = media_mod.generate_thumbnail(filepath, output_path, at_time, width, height)

The skill documents CLI invocations that read the automated Safari session's cookies and local storage and redirect the exported JSON to a file outside the workspace (/tmp/storage.json), placing session credential material at a world-readable path with no network sink shown.

cli-anything-safari --json tool export-storage > /tmp/storage.json