How do I install the Opencli Readonly Probe skill?

Run npx skillmds@latest add yangshu2087/opencli-readonly-probe in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Opencli Readonly Probe safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Opencli Readonly Probe?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Opencli Readonly Probe free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Opencli Readonly Probe?

yangshu2087 (@yangshu2087) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Opencli Readonly Probe by yangshu2087

Name: Opencli Readonly Probe
Author: yangshu2087

File contents

OpenCLI Read-Only Probe

Overview

Use OpenCLI only through the workspace wrapper. The wrapper keeps OpenCLI out of global PATH, forces an isolated HOME/runtime for OpenCLI-backed commands, restricts commands to a small allowlist, and stops the OpenCLI daemon on exit. The GitHub status checks deliberately use local gh directly to avoid OpenCLI external auto-install behavior.

Wrapper:

/Users/yangshu/Codex/scripts/opencli-readonly.sh

Allowed Commands

Need	Command
HackerNews public reads	`scripts/opencli-readonly.sh hackernews top --limit 5 -f json`
Other HackerNews public reads	`scripts/opencli-readonly.sh hackernews new
Local GitHub CLI version	`scripts/opencli-readonly.sh gh --version`
Local GitHub auth status	`scripts/opencli-readonly.sh gh auth status`
Codex Desktop CDP reachability	`scripts/opencli-readonly.sh codex status`
Codex Desktop current model	`scripts/opencli-readonly.sh codex model`
Codex Desktop current thread read	`scripts/opencli-readonly.sh codex read`

Hard Rules

Do not run opencli directly for Codex work; use the wrapper.
Do not install OpenCLI globally or add shell completion.
Do not install the Browser Bridge extension unless the user explicitly approves it in a separate task.
Do not run write-capable commands: reddit, codex send/new/ask/export, gh repo/pr/issue, browser, plugin, install, or register.
The wrapper forces OpenCLI HOME into /tmp; gh --version and gh auth status use the local gh binary directly and never delegate to OpenCLI external CLI auto-install.
Treat codex read as sensitive: summarize only what is necessary and avoid exposing unrelated private thread content.
If Codex Desktop CDP is not reachable, report the gap; do not restart Codex with --remote-debugging-port unless explicitly asked.

Verification

Before trusting results, run the narrow checks:

bash -n /Users/yangshu/Codex/scripts/opencli-readonly.sh
/Users/yangshu/Codex/scripts/opencli-readonly.sh --help
/Users/yangshu/Codex/scripts/opencli-readonly.sh hackernews top --limit 3 -f json
/Users/yangshu/Codex/scripts/opencli-readonly.sh gh --version
/Users/yangshu/Codex/scripts/opencli-readonly.sh codex status

After use, confirm daemon cleanup:

curl -fsS --max-time 2 -H 'X-OpenCLI: 1' http://127.0.0.1:19825/status || true

---name: opencli-readonly-probedescription: Use when evaluating OpenCLI from Codex with strict read-only constraints, especially for HackerNews, local GitHub CLI status, or Codex Desktop CDP reachability checks.---# OpenCLI Read-Only Probe## OverviewUse OpenCLI only through the workspace wrapper. The wrapper keeps OpenCLI out of global PATH, forces an isolated HOME/runtime for OpenCLI-backed commands, restricts commands to a small allowlist, and stops the OpenCLI daemon on exit. The GitHub status checks deliberately use local `gh` directly to avoid OpenCLI external auto-install behavior.Wrapper:```bash/Users/yangshu/Codex/scripts/opencli-readonly.sh```## Allowed Commands| Need | Command ||---|---|| HackerNews public reads | `scripts/opencli-readonly.sh hackernews top --limit 5 -f json` || Other HackerNews public reads | `scripts/opencli-readonly.sh hackernews new|best|ask|show|jobs|search|user ...` || Local GitHub CLI version | `scripts/opencli-readonly.sh gh --version` || Local GitHub auth status | `scripts/opencli-readonly.sh gh auth status` || Codex Desktop CDP reachability | `scripts/opencli-readonly.sh codex status` || Codex Desktop current model | `scripts/opencli-readonly.sh codex model` || Codex Desktop current thread read | `scripts/opencli-readonly.sh codex read` |## Hard Rules- Do not run `opencli` directly for Codex work; use the wrapper.- Do not install OpenCLI globally or add shell completion.- Do not install the Browser Bridge extension unless the user explicitly approves it in a separate task.- Do not run write-capable commands: `reddit`, `codex send/new/ask/export`, `gh repo/pr/issue`, `browser`, `plugin`, `install`, or `register`.- The wrapper forces OpenCLI `HOME` into `/tmp`; `gh --version` and `gh auth status` use the local `gh` binary directly and never delegate to OpenCLI external CLI auto-install.- Treat `codex read` as sensitive: summarize only what is necessary and avoid exposing unrelated private thread content.- If Codex Desktop CDP is not reachable, report the gap; do not restart Codex with `--remote-debugging-port` unless explicitly asked.## VerificationBefore trusting results, run the narrow checks:```bashbash -n /Users/yangshu/Codex/scripts/opencli-readonly.sh/Users/yangshu/Codex/scripts/opencli-readonly.sh --help/Users/yangshu/Codex/scripts/opencli-readonly.sh hackernews top --limit 3 -f json/Users/yangshu/Codex/scripts/opencli-readonly.sh gh --version/Users/yangshu/Codex/scripts/opencli-readonly.sh codex status```After use, confirm daemon cleanup:```bashcurl -fsS --max-time 2 -H 'X-OpenCLI: 1' http://127.0.0.1:19825/status || true```

Frequently asked questions

Opencli Readonly Probe