The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill programmatically extracts sensitive Google authentication cookies (including __Secure-1PSID and __Secure-1PSIDTS) from a local Chrome/Chromium installation.
Evidence: Found in scripts/gemini-webapi/utils/load-browser-cookies.ts which uses baoyu-chrome-cdp to connect to running browsers or launch instances to capture cookies.
Evidence: Extracted cookies are stored locally in a cookies.json file as seen in scripts/gemini-webapi/utils/cookie-file.ts.
[COMMAND_EXECUTION]: The skill executes shell commands to resolve environment paths and run its core logic.
Evidence: scripts/gemini-webapi/utils/paths.ts uses execSync to run cmd.exe and wslpath for path resolution in WSL environments.
Evidence: SKILL.md instructs the agent to execute TypeScript files using bun or npx -y bun.
[DATA_EXFILTRATION]: The skill transmits the extracted authentication cookies to Google's servers to facilitate API requests.
Evidence: scripts/gemini-webapi/client.ts and scripts/gemini-webapi/utils/get-access-token.ts perform network requests to gemini.google.com and accounts.google.com using the captured credentials.
[EXTERNAL_DOWNLOADS]: The skill downloads and saves images from external Google-hosted URLs.
Evidence: scripts/gemini-webapi/types/image.ts uses fetch to download images from lh3.googleusercontent.com and saves them to the local file system.
[SAFE]: The skill implements a mandatory consent check flow (Consent Check (REQUIRED) in SKILL.md) that requires the user to explicitly accept a disclaimer before any reverse-engineering or cookie extraction takes place.

baoyu-danger-gemini-web