The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill implements a sophisticated mechanism to harvest sensitive Google authentication cookies from the user's browser.
Evidence in scripts/gemini-webapi/utils/load-browser-cookies.ts shows the use of Chrome DevTools Protocol (CDP) via Network.getCookies to programmatically extract __Secure-1PSID and __Secure-1PSIDTS from an active browser session.
[COMMAND_EXECUTION]: The skill spawns external browser processes to facilitate the automated extraction of session tokens.
Evidence in scripts/gemini-webapi/utils/load-browser-cookies.ts shows the use of node:child_process's spawn function to launch Chrome, Edge, or Chromium with remote debugging enabled (--remote-debugging-port).
The executable path is dynamically determined and can be overridden via the GEMINI_WEB_CHROME_PATH environment variable, which could lead to arbitrary execution if the environment is compromised.
[DATA_EXFILTRATION]: The skill harvests local sensitive authentication tokens and caches them in a persistent file outside the skill's own directory.
Evidence in scripts/gemini-webapi/utils/cookie-file.ts and scripts/gemini-webapi/utils/paths.ts shows cookies being saved to cookies.json in a persistent data directory (e.g., ~/.local/share/canghe-skills/gemini-web/).
[PERSISTENCE]: The skill maintains long-term access to the user's account by implementing token rotation and local caching.
Evidence in scripts/gemini-webapi/utils/rotate-1psidts.ts shows logic that periodically calls Google's RotateCookies endpoint to refresh harvested session tokens.
[INDIRECT_PROMPT_INJECTION]: The skill has a high vulnerability surface for indirect prompt injection due to its ability to process local files and images without sanitization.
Ingestion points: The --promptfiles and --reference flags in scripts/main.ts allow the agent to read external file content.
Boundary markers: Absent. File contents are concatenated directly into the prompt string without delimiters or instructions to ignore embedded commands.
Capability inventory: The skill possesses file writing capabilities, network access to Google APIs, and the ability to spawn subprocesses.
Sanitization: Absent. External content is interpolated directly into the model request.

canghe-danger-gemini-web