opencli-adapter-author
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes jsluice, an open-source tool by BishopFox, for scanning JavaScript bundles during the reconnaissance phase. BishopFox is a well-known security firm, and the tool's use is documented for analytical purposes rather than runtime execution within adapters.- [COMMAND_EXECUTION]: The skill guides the user through the use of the opencli platform's subcommands (e.g., opencli doctor, opencli browser analyze, opencli browser verify). These are standard operational tools for the development and testing of site adapters within the opencli ecosystem.- [DYNAMIC_EXECUTION]: The adapter templates generated by the skill utilize page.evaluate to perform DOM extraction within a browser context. This is a standard and intended functionality of the opencli platform for browser automation, and the skill provides guidelines on executing this code securely.- [DATA_EXFILTRATION]: The skill includes explicit security mandates to prevent the leakage of sensitive information. It requires the redaction of auth headers (Cookie, Authorization) and provides a clear data classification policy that prohibits the storage of high-sensitivity user data in persistent site memory.- [INDIRECT_PROMPT_INJECTION]: Because the skill processes data from external websites, it implements a 'Contract Gate' and an 'Evidence Ledger' to validate the structure, identity, and semantics of the data. This rigorous validation process acts as a safeguard against the processing of unexpected or malicious external content.
Audit Metadata