baoyu-danger-gemini-web
Warn
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/gemini-webapi/utils/load-browser-cookies.tsuses thechild_process.spawnfunction to execute browser binaries (Chrome, Chromium, or Edge) with the--remote-debugging-portflag, allowing programmatic interaction with the browser process. - [DATA_EXFILTRATION]: The skill captures sensitive session cookies from the browser using a WebSocket connection to the Chrome DevTools Protocol. It specifically targets authentication tokens for Google domains, which are then stored in a local JSON file and used for subsequent network requests to Gemini endpoints.
- [PROMPT_INJECTION]: The skill accepts external content through the
--promptfilesand--referenceparameters inscripts/main.ts. These ingestion points provide a surface for indirect prompt injection as the content is passed to the Gemini model without explicit sanitization or instruction delimiters. Capability inventory includes the ability to make authenticated API requests to Gemini services based on the processed inputs.
Audit Metadata