qiaomu-opencli-autofix

Warn

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill's primary workflow involves a loop of diagnosing, patching, and executing source code. It uses the Edit and Write tools to modify TypeScript files (.ts adapters) and then uses the Bash tool to execute the modified code via opencli. This automated self-repair mechanism is a form of dynamic execution.
  • [COMMAND_EXECUTION]: The skill executes various opencli subcommands (e.g., opencli doctor, opencli browser, and site-specific commands). These commands trigger complex local logic and browser interactions based on external parameters.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external, untrusted sources (website DOM snapshots and network request logs) provided in diagnostic.json. This data is then used by the AI agent to determine how to 'patch' the adapter code.
  • Ingestion points: The diagnostic.json file, specifically the page.snapshot and page.networkRequests fields, which contain content directly scraped from external websites.
  • Boundary markers: The skill instructs the agent to extract JSON data located between specific ___OPENCLI_DIAGNOSTIC___ markers in stderr output.
  • Capability inventory: The skill utilizes Bash(opencli:*), Read, Edit, and Write capabilities, enabling it to both modify and execute local code.
  • Sanitization: The instructions lack a specific sanitization or validation process for the content of the website snapshots before they are used to influence code changes, relying entirely on the agent's interpretation to avoid injecting malicious logic.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Sep 14, 2026, 03:04 PM