Skill

opencli-browser

skill:jackwener/opencli#opencli-browser

Drive Chrome with OpenCLI to inspect pages, interact with logged-in sites, capture API evidence, and manage native tabs, groups and windows. For reusable adapters, see opencli-adapter-author.

skills.sh SkillsMP

Verdict

Inconclusive

The analysis could not cover enough of the artifact to decide.

Analyzed Oct 27, 2026, 21:13 UTC at 97dc0cd

findings

—

highest severity

threat classes

2,349

files scanned

19/19

checks satisfied

package advisories

Why this verdict

inconclusive: unresolved question on CRED
inconclusive: unresolved question on EXEC

Security findings 0

No individual findings recorded

The inconclusive verdict rests on the open questions below; 1 candidate finding was refuted on review.

Open questions 9

What the analysis could not settle from the code alone.

The `opencli` executable that every instruction in this skill invokes is not shown in this batch; its provenance, version pinning, and runtime behavior (network destinations, credential access) cannot be verified from the shown units.

Supply chain

Detector lead DET:07046cfda4d70565 claims the `opencli` CLI exposes an undeclared file_write capability tied to `--help`; the shown text only documents `--help -f json` as a structured help surface, and the opencli binary's actual behavior is not present in the shown units, so the claimed write cannot be confirmed.

Persistence

What is the full method surface of `opencli browser chrome call` beyond the documented tabs/tabGroups examples — `chrome describe` mentions 'supported methods, signatures, live permissions' without listing them, so it is unknown whether sensitive Chrome APIs (cookies, storage, debugging) are reachable and could expose credentials of logged-in sites.

Credential access

[file request skills/opencli-browser/bin/opencli] If this file ships the opencli executable or a wrapper for it, what do its subcommands (list, doctor, browser, browser chrome call) do beyond documented browser automation, specifically file writes, network sends, and credential access?

Code execution

[file request skills/opencli-browser/install.sh] Does the skill ship an install script at this path, and if so what does it download, execute, or write at install time?

Supply chain

[file request skills/opencli-browser/package.json] If the skill ships a node package, do its bin entries, bundled files, or its own preinstall/postinstall scripts ship or fetch the opencli CLI, and what exactly runs at install time?

Supply chain

[file request skills/opencli-browser] Does this skill ship or reference the `opencli` binary, a wrapper script, or an install script, and if so what network destinations, credential access, or install-time execution does that code perform?

Supply chain

[file request skills/opencli-browser] Does this artifact ship the `opencli` executable or any install/doctor script that SKILL.md instructs the agent to run, and if so do its subcommands (`--help`, `doctor`, `browser`) perform file writes or network sends beyond the documented browser-automation behavior?

Code execution

[file request skills/opencli-browser] Where is the supported-method list for `opencli browser chrome call` defined, and does that surface include credential-sensitive Chrome APIs (cookies, webRequest, storage) in addition to the documented tabs and tabGroups methods?

Credential access

Refuted findings 1

Candidates the review stage examined and rejected, kept for transparency.

Supply chain

highRefutedlow confidence

The skill grants a wildcard Bash permission and instructs the agent to run opencli subcommands while shipping no opencli executable, installer, or package manifest, so the agent executes whatever binary `opencli` resolves to at runtime with behavior unreviewable from this artifact.

skills/opencli-browser/SKILL.md:1-6

allowed-tools: Bash(opencli:*), Read, Edit, Write

Why it was refuted

Strongest case for the finding: the skill invokes a binary it does not ship, so runtime behavior is unreviewable. Strongest case against: the Bash grant is scoped to `opencli:*` rather than broad, and running OpenCLI subcommands is exactly the skill's declared core capability (plus declared mandatory exec claim D1), which falls under the declared-core-capability and permissions-alone carve-outs; the residue hits (an example.com sample command, a `--help` flag) add no concealed behavior. The supply-chain harm theory is therefore carved out and the finding is refuted.