tuzi-danger-gemini-web
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill launches browser processes (Chrome, Edge, or Chromium) using
child_process.spawnto facilitate automated authentication. It uses the Chrome DevTools Protocol (CDP) to extract session cookies required for API access. It also usesexecSyncto resolve file paths when running within a WSL environment. - [EXTERNAL_DOWNLOADS]: The skill instructions specify the use of
npx -y bun, which may trigger the download of the Bun runtime. The skill also downloads generated images and uploads reference images to official Google and Google APIs endpoints. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data in the form of user prompts and reference files, which are transmitted to the Gemini Web API.
- Ingestion points: User-provided text via the
--promptargument, content from local files via--promptfiles, and image data via--reference(found inscripts/main.ts). - Boundary markers: None. The skill passes input directly to the API without structural delimiters or instruction-bypass warnings.
- Capability inventory: The skill can perform network requests to Google, write generated images to the local filesystem, and manage session state in JSON files.
- Sanitization: No input sanitization or filtering is applied to the prompt text before transmission.
Audit Metadata