The Agent Skills Directory

[COMMAND_EXECUTION]: The skill programmatically launches a web browser (Chrome, Chromium, or Microsoft Edge) to facilitate session hijacking for authentication purposes.
Evidence: In scripts/gemini-webapi/utils/load-browser-cookies.ts, the launch_chrome function uses child_process.spawn to execute a browser with the --remote-debugging-port flag.
The executable path is determined by searching common system directories or can be overridden via the GEMINI_WEB_CHROME_PATH environment variable.
[CREDENTIALS_UNSAFE]: The skill is designed to extract sensitive Google authentication cookies from the user's browser session.
Evidence: The fetch_google_cookies_via_cdp function in scripts/gemini-webapi/utils/load-browser-cookies.ts connects to the browser's debug port via WebSocket to extract __Secure-1PSID and __Secure-1PSIDTS cookies.
These cookies provide full access to the user's Google Gemini account and are subsequently used to authenticate reverse-engineered API requests.
[PERSISTENCE]: The skill maintains access to the user's account by storing extracted credentials and chat history in a persistent local directory.
Evidence: Sensitive cookies are written to a cookies.json file, and chat sessions are stored as JSON files in a dedicated sessions/ directory within the user's application data folder (e.g., ~/Library/Application Support/baoyu-skills/gemini-web/).
[EXTERNAL_DOWNLOADS]: The skill downloads generated images from Google's content delivery networks to the local file system.
Evidence: The Image.save method in scripts/gemini-webapi/types/image.ts uses fetch to download images from URLs like googleusercontent.com and saves them to a local directory (defaulting to temp/).
[INDIRECT_PROMPT_INJECTION]: The skill presents an attack surface for indirect prompt injection by processing untrusted data from both user-supplied files and external API responses without rigorous sanitization.
Ingestion points: The skill reads prompt content from files via the --promptfiles flag and processes structured JSON responses from the Gemini Web API.
Boundary markers: The skill does not implement explicit delimiters or boundary markers to distinguish between instructions and data when interpolating content into the API request.
Capability inventory: The skill has the capability to write to the file system (saving images and sessions) and perform network operations.
Sanitization: While basic HTML entity decoding is performed in scripts/gemini-webapi/types/candidate.ts, there is no validation or filtering of the content to prevent embedded instructions from influencing the agent's behavior.

baoyu-danger-gemini-web