baoyu-danger-gemini-web
Warn
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
node:child_processmodule to launch browser executables (such as Google Chrome, Microsoft Edge, or Chromium) with specific flags (--remote-debugging-port,--user-data-dir) to automate cookie extraction via the Chrome DevTools Protocol (CDP) inscripts/gemini-webapi/utils/load-browser-cookies.ts. - [CREDENTIALS_UNSAFE]: The skill manages highly sensitive Google session cookies (
__Secure-1PSIDand__Secure-1PSIDTS). It reads and writes these credentials to a local JSON file (cookies.json) within the user's application data directory, which could lead to unauthorized access if the local environment is compromised. - [EXTERNAL_DOWNLOADS]: The documentation and usage examples frequently reference
npx -y bun, which involves downloading and executing the Bun runtime from the public NPM registry. - [INDIRECT_PROMPT_INJECTION]: The skill processes and interprets text and image data returned from the Gemini Web API, which is an untrusted external source.
- Ingestion points: API response stream parsed in
scripts/gemini-webapi/client.ts. - Boundary markers: No explicit delimiters or instructions are used to separate AI-generated content from system instructions.
- Capability inventory: Includes file system write operations (saving images in
scripts/gemini-webapi/types/image.ts, saving session history inscripts/main.ts) and network request capabilities via thefetchAPI. - Sanitization: Implements basic HTML entity decoding for text candidates in
scripts/gemini-webapi/types/candidate.ts.
Audit Metadata