baoyu-danger-gemini-web
Warn
Audited by Gen Agent Trust Hub on Mar 16, 2026
Risk Level: MEDIUMCREDENTIALS_UNSAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill programmatically accesses and extracts sensitive authentication cookies (such as __Secure-1PSID and __Secure-1PSIDTS) from the user's local browser data directories. These credentials are stored in a local JSON file (cookies.json) within the skill's data directory to maintain authenticated sessions with Google services.
- [COMMAND_EXECUTION]: The script load-browser-cookies.ts identifies and spawns local browser executables (Google Chrome, Microsoft Edge, or Chromium) using the node:child_process module. This is used to open a debugging session via the Chrome DevTools Protocol (CDP) to programmatically retrieve session tokens.
- [EXTERNAL_DOWNLOADS]: The skill's usage instructions recommend execution via 'npx -y bun', which triggers the download and execution of the Bun runtime or related packages from the NPM registry if they are not already present.
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it retrieves and processes content from an external AI service (Gemini Web API) without sanitization.
- Ingestion points: External prompt data and local files provided via the --promptfiles and --reference arguments in scripts/main.ts.
- Boundary markers: Absent; external and internal inputs are concatenated directly when constructing the API request.
- Capability inventory: The skill has capabilities for command execution (spawning browser processes), file system operations (reading/writing cookies, sessions, and generated images), and network access (HTTPS/WebSocket connections to Google endpoints).
- Sanitization: There is no validation or escaping of the model output before it is returned to the agent or saved to the file system.
Audit Metadata