baoyu-danger-gemini-web
Warn
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: MEDIUMCREDENTIALS_UNSAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill extracts and manages sensitive Google session cookies (__Secure-1PSID and __Secure-1PSIDTS) to authenticate with the Gemini Web API. These credentials grant full access to the user's Google session and are stored in a local JSON file (cookies.json) within the application support directory.
- [COMMAND_EXECUTION]: The skill uses the child_process.spawn function in scripts/gemini-webapi/utils/load-browser-cookies.ts to launch local browser processes (Chrome, Edge, or Chromium) with the --remote-debugging-port flag. This allows the skill to automate the browser and capture session cookies via the Chrome DevTools Protocol.
- [EXTERNAL_DOWNLOADS]: The skill performs network requests to multiple Google-owned domains including gemini.google.com, accounts.google.com, and content-push.googleapis.com. It also downloads generated images from googleusercontent.com to the local filesystem.
- [PROMPT_INJECTION]: The skill processes untrusted text and image data returned from the Gemini API, creating a surface for indirect prompt injection. Ingestion points: The ModelOutput and Candidate classes in scripts/gemini-webapi/types/ process raw API responses. Boundary markers: No explicit delimiters or instructions are used to separate API content from agent instructions. Capability inventory: The skill has the ability to spawn processes, write local files, and perform network requests. Sanitization: Only basic HTML entity decoding is applied to text output.
Audit Metadata