baoyu-danger-gemini-web
Fail
Audited by Gen Agent Trust Hub on Jun 28, 2026
Risk Level: HIGHCREDENTIALS_UNSAFECOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill performs automated extraction of sensitive session cookies (
__Secure-1PSIDand__Secure-1PSIDTS) from the user's web browser. This is implemented inscripts/gemini-webapi/utils/load-browser-cookies.tsusing the Chrome DevTools Protocol (CDP). - [COMMAND_EXECUTION]: The skill launches browser processes (Chrome, Edge, etc.) via
child_process.spawnto facilitate the extraction of session cookies. The executable path can be influenced by theGEMINI_WEB_CHROME_PATHenvironment variable. - [DATA_EXFILTRATION]: Sensitive Google authentication cookies are scraped from the browser and stored in a local JSON file at a path such as
~/Library/Application Support/baoyu-skills/gemini-web/cookies.json(on macOS) or similar paths on other platforms. This exposes the user's persistent Google session to the local filesystem in an unencrypted format. - [EXTERNAL_DOWNLOADS]: The skill downloads generated images and web content from Google's domains (
google.com,googleusercontent.com) and uploads local files for vision-based processing tocontent-push.googleapis.com. - [PROMPT_INJECTION]: As a tool that processes arbitrary user input and interpolates it into network requests to an external LLM, it is susceptible to indirect prompt injection if the processed data (e.g., contents of
--promptfiles) contains malicious instructions designed to influence the agent's next steps.
Recommendations
- AI detected serious security threats
Audit Metadata