Opencli ReaderSAFE

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: opencli-reader
description: >
  Generic read-only fallback for sources opencli supports but no dedicated skill
  covers: finance sites (Yahoo Finance, Bloomberg, Reuters, Barchart, Eastmoney,
  Xueqiu, Sinafinance), communities (Reddit, HackerNews, Weibo, Zhihu, Xiaohongshu,
  Bilibili), newsletters and blogs (Substack, Medium), research (arXiv, Google
  Scholar), podcasts and video (Apple Podcasts, Xiaoyuzhou, Spotify, YouTube), Weixin,
  Amazon, and more. Use it when the user asks to read or fetch from such a site — for
  example r/wallstreetbets, the HackerNews front page, Eastmoney hot stocks, the
  Xueqiu feed, Bloomberg markets headlines, or an arXiv search — or says "use opencli
  to read". Prefer twitter-reader, linkedin-reader, discord-reader, telegram-reader,
  or yc-reader when the source matches. Read-only: never runs write commands.
---

# opencli Reader (Generic Fallback, Read-Only)

Generic fallback for any source opencli supports via its [adapter registry](https://github.com/jackwener/opencli) (100+ sites, growing). Use this skill only when **no dedicated finance-skill covers the source** — the specialized skills (`twitter-reader`, `linkedin-reader`, `discord-reader`, `telegram-reader`, `yc-reader`) are always preferred when the request matches one of them.

**This skill is read-only.** Write commands that opencli exposes (post, like, comment, send, save, upvote, subscribe, follow, delete, reply-dm, etc.) must not be invoked.

---

## Step 1: Decide Whether to Use This Skill

Only use this skill if the request **cannot** be handled by a more specific skill.

| If the user asks about... | Use this skill instead |
|---|---|
| Twitter/X | `twitter-reader` |
| LinkedIn | `linkedin-reader` |
| Discord | `discord-reader` |
| Telegram | `telegram-reader` |
| Y Combinator | `yc-reader` |
| Anything else opencli supports (Yahoo Finance, Bloomberg, Reuters, Reddit, HackerNews, Eastmoney, Xueqiu, Substack, arXiv, etc.) | **this skill** |

If the source is not in opencli's registry either, stop and tell the user the request isn't covered — don't fall back to ad-hoc scraping.

---

## Step 2: Ensure opencli Is Ready

**Current environment status:**

```
!`(command -v opencli && opencli doctor 2>&1 | head -5 && echo "READY" || echo "SETUP_NEEDED") 2>/dev/null || echo "NOT_INSTALLED"`
```

If `NOT_INSTALLED`:

```bash
npm install -g @jackwener/opencli
```

If `SETUP_NEEDED`, guide the user through Browser Bridge setup (only required for adapters whose strategy is `COOKIE`, `HEADER`, `INTERCEPT`, or `UI` — `PUBLIC` and `LOCAL` adapters work without a browser):

1. Download the latest `opencli-extension-v{version}.zip` from the [GitHub Releases page](https://github.com/jackwener/opencli/releases)
2. Unzip it, open `chrome://extensions` in Chrome, enable **Developer mode**
3. Click **Load unpacked** and select the unzipped folder
4. Make sure Chrome is logged into the target site, then re-run `opencli doctor`

Requires Node.js >= 20 (or Bun >= 1.0).

---

## Step 3: Discover the Right Command

**Do not guess command names or flags** — the registry has 500+ commands and changes weekly. Instead:

```bash
# Full registry (grouped by site), machine-readable JSON
opencli list -f json

# Filter to a site
opencli list | grep -i <site>

# Site-level help (all commands + flags)
opencli <site> --help

# Command-level help (positional args + flags + defaults)
opencli <site> <command> --help
```

The `opencli list -f json` entry for each command includes:
- `site` — adapter namespace (e.g., `yahoo-finance`)
- `name` — subcommand (e.g., `quote`)
- `strategy` — `PUBLIC` / `COOKIE` / `HEADER` / `INTERCEPT` / `UI` / `LOCAL` — tells you if a browser login is needed
- `description`, `args`, `columns` — canonical metadata

Use `opencli list -f json` as the source of truth. Never paste a site list into the plan from memory; adapters are added every week.

### Quick map of the most common finance / research sources

The table below is a **shortlist**, not exhaustive — always confirm with `opencli <site> --help`.

| Source | Site slug | Common commands |
|---|---|---|
| Yahoo Finance | `yahoo-finance` | `quote` |
| Bloomberg | `bloomberg` | `markets`, `economics`, `industries`, `tech`, `politics`, `opinions`, `news`, `businessweek`, `feeds`, `main` |
| Reuters | `reuters` | `search` |
| Eastmoney (东方财富) | `eastmoney` | `quote`, `rank`, `kline`, `sectors`, `etf`, `holders`, `money-flow`, `northbound`, `longhu`, `kuaixun`, `convertible`, `index-board`, `announcement`, `hot-rank` |
| Xueqiu (雪球) | `xueqiu` | `stock`, `hot-stock`, `hot`, `feed`, `comments`, `watchlist`, `search`, `groups`, `fund-snapshot`, `fund-holdings`, `earnings-date`, `kline` |
| Sinafinance | `sinafinance` | (see `--help`) |
| TDX / THS | `tdx`, `ths` | (see `--help`) |
| Barchart (options) | `barchart` | `quote`, `options`, `flow`, `greeks` |
| Reddit | `reddit` | `hot`, `popular`, `frontpage`, `search`, `subreddit`, `read`, `user`, `user-posts`, `user-comments`, `saved` |
| HackerNews | `hackernews` | `top`, `best`, `new`, `ask`, `show`, `jobs`, `user`, `search` |
| Substack | `substack` | `feed`, `publication`, `search` |
| Medium | `medium` | (see `--help`) |
| arXiv | `arxiv` | (see `--help`) |
| Google Scholar | `google-scholar` | (see `--help`) |
| Weibo | `weibo` | (see `--help`) |
| Bilibili | `bilibili` | `hot`, `video` + more |
| Xiaohongshu (小红书) | `xiaohongshu` | (see `--help`) |
| Rednote (小红书 international) | `rednote` | (see `--help` — mirrors `xiaohongshu`) |
| Zhihu | `zhihu` | (see `--help`) |
| Baidu Scholar | `baidu-scholar` | (see `--help`) |
| Wanfang | `wanfang` | (see `--help`) |
| 36kr | `36kr` | (see `--help`) |
| Jike | `jike` | (see `--help`) |
| Bluesky | `bluesky` | (see `--help`) |
| Apple Podcasts | `apple-podcasts` | (see `--help`) |
| Xiaoyuzhou (podcasts) | `xiaoyuzhou` | (see `--help`) |
| Spotify | `spotify` | (see `--help`) |
| YouTube | `youtube` | (see `--help`) |
| Weixin Official Account | 

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

What the source does

Filesystem

none-observed

Network

none-observed

Shell

none-observed

Dependencies

pinned

Secrets in source

none-found

Findings (0)

No findings outside the package's declared scope.

Gates applied: no_behavioural_pass.