qiaomu-opencli-autofix
Warn
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill's primary workflow involves a loop of diagnosing, patching, and executing source code. It uses the
EditandWritetools to modify TypeScript files (.tsadapters) and then uses theBashtool to execute the modified code viaopencli. This automated self-repair mechanism is a form of dynamic execution. - [COMMAND_EXECUTION]: The skill executes various
openclisubcommands (e.g.,opencli doctor,opencli browser, and site-specific commands). These commands trigger complex local logic and browser interactions based on external parameters. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external, untrusted sources (website DOM snapshots and network request logs) provided in
diagnostic.json. This data is then used by the AI agent to determine how to 'patch' the adapter code. - Ingestion points: The
diagnostic.jsonfile, specifically thepage.snapshotandpage.networkRequestsfields, which contain content directly scraped from external websites. - Boundary markers: The skill instructs the agent to extract JSON data located between specific
___OPENCLI_DIAGNOSTIC___markers in stderr output. - Capability inventory: The skill utilizes
Bash(opencli:*),Read,Edit, andWritecapabilities, enabling it to both modify and execute local code. - Sanitization: The instructions lack a specific sanitization or validation process for the content of the website snapshots before they are used to influence code changes, relying entirely on the agent's interpretation to avoid injecting malicious logic.
Audit Metadata