opencli-rs

Fail

Audited by Gen Agent Trust Hub on Mar 25, 2026

Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill provides instructions to install the opencli-rs utility using a remote script via 'curl | sh'. This execution pattern runs code from a remote source directly in the system shell. Note: The source is the author's official repository.
  • [COMMAND_EXECUTION]: The skill exposes administrative CLI passthroughs for tools like docker, kubectl, and gh. It also instructs the agent on a 'self-iteration' capability to create new website adapters by writing YAML files to ~/.opencli-rs/adapters/ that contain and execute Javascript logic.
  • [DATA_EXFILTRATION]: The skill's core functionality involves accessing user data on 55+ websites by reusing active Chrome browser login sessions. This allows the agent to read and modify sensitive personal data on social and content platforms without requiring API keys.
  • [PROMPT_INJECTION]: The skill creates an indirect prompt injection surface by processing data from dozens of external websites. * Ingestion points: Social media and forum content retrieved via the opencli-rs tool from sites like Twitter, Reddit, and Bilibili. * Boundary markers: Absent; no delimiters or ignore-instructions are used to isolate untrusted web content. * Capability inventory: The skill can read browser credentials, write to the local filesystem, and execute commands via external tool passthroughs. * Sanitization: Absent; external data is not validated or escaped before being processed by the agent.
Recommendations
  • HIGH: Downloads and executes remote code from: https://raw.githubusercontent.com/nashsu/opencli-rs/main/scripts/install.sh - DO NOT USE without thorough review
Audit Metadata
Risk Level
HIGH
Analyzed
Mar 25, 2026, 09:51 AM