The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes the Bash(opencli:*) tool to interface with a local browser automation daemon, providing a broad interaction surface with the host system.
[DATA_EXFILTRATION]: The skill is explicitly configured to "reuse existing login sessions," allowing the agent to access private user data from any authenticated website. Commands such as network --detail and get html facilitate the extraction of this data, which could include PII or session secrets.
[DYNAMIC_EXECUTION]: The "Sedimentation" feature allows the agent to write TypeScript code to ~/.opencli/clis/ and execute it via the verify command. This enables the creation and execution of persistent local code based on agent-determined logic.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external websites through state, get text, and network commands, creating a vulnerability to indirect prompt injection. 1. Ingestion points: Browser interaction commands (state, get text, get html, network) in SKILL.md. 2. Boundary markers: Absent. The instructions do not specify any delimiters or safety warnings for processing external content. 3. Capability inventory: Shell command execution via Bash and filesystem Write access for script generation. 4. Sanitization: Absent. No sanitization logic is prescribed for data retrieved from the web.

qiaomu-opencli-browser