Enable Chrome Gemini

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:17 AM UTC
• Version: 1.0.0

Overview

This skill openly modifies Chrome profile state to force-enable Gemini outside normal regional eligibility, so users should review it before installing.

Install only if you deliberately want a tool that edits Chrome's Local State to make Gemini/Glic appear eligible, including changing region fields to US and, by default, Chrome language fields to en-US. Run --dry-run first, close Chrome before writing, keep the generated backup, and avoid using it on managed or primary profiles if unsupported-region behavior or language changes could cause problems.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/repair_chrome_gemini.py:133

Finding

Chrome Gemini Regional and Eligibility Controls Can Be Overridden

Content

View full analysis

'us'") data["variations_country"] = "us" current_perm = data.get("variations_permanent_consistency_country") updated_perm = normalize_country_list(current_perm, "us") if updated_perm != current_perm: changes.append( "variations_permanent_consistency_country: " f"{current_perm!r} -> {updated_perm!r}" ) data["variations_permanent_consistency_country"] = updated_perm for key in ( "variations_safe_seed_permanent_consistency_country", "variations_safe_seed_session_consistency_country", ): if data.get(key) != "us": changes.append(f"{key}: {data.get(key)!r} -> 'us'") data[key] = "us" glic = data.get("glic") if not isinstance(glic, dict): changes.append("glic: created missing object") glic = {} data["glic"] = glic if glic.get("is_glic_eligible") is not True: changes.append(f"glic.is_glic_eligible: {glic.get('is_glic_eligible')!r} -> True") glic["is_glic_eligible"] = True browser = data.get("browser") if not isinstance(browser, dict): changes.append("browser.enabled_labs_experiments: created missing object") browser = {} data["browser"] = browser experiments = ensure_list(browser.get("enabled_labs_experiments")) added = [] for entry in ("glic@1", "glic-side-panel@1"): if entry not in experiments: experiments.append(entry) added.append(entry) ``` ### Technical Analysis The script directly rewrites Chrome's locally stored country and feature-eligibility state. It changes multiple variation-country properties to `us`, sets `glic.is_glic_eligible` to `True`, and adds the Glic experiments to the enabled experime ...[truncated 2390 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill clearly directs execution of a Python script that reads and writes Chrome profile data and relies on shell execution, but the manifest does not declare any tool scope or permissions. That omission weakens reviewability and containment because consumers cannot easily tell that filesystem and command execution are required before using the skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The workflow instructs users to alter Chrome's eligibility, region, and locale state to force-enable Gemini outside its normal availability, but it does not prominently warn about side effects. This can mislead users into changing browser behavior, account-facing region signals, or unsupported feature states without informed consent, increasing the chance of breakage or policy/terms conflicts.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill normalizes Chrome language settings to en-US as part of the default patch flow rather than making it an explicit, informed choice. Forced locale changes can affect UI language, content negotiation, and user expectations across browsing sessions, making this an unsafe default for a profile-level repair tool.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The default prompt auto-invokes the skill for broadly phrased requests to 'set up Gemini in Chrome automatically' and to repair multiple symptoms, without clearly limiting when the skill should engage or requiring confirmation before making system/browser changes. In context, this is risky because the skill appears capable of modifying Chrome state, region, flags, and language settings across operating systems, so ambiguous activation can lead to unintended configuration changes.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The default prompt explicitly includes 'region and language normalization,' which indicates the skill may alter user locale-related settings without a separate, informed opt-in. In this skill's context, that is more dangerous because changing browser language or regional eligibility fields can affect user experience, policy/compliance posture, and service behavior beyond the narrow goal of troubleshooting Gemini availability.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/repair_chrome_gemini.py (reported line 42)May include surrounding context.

python

if system == "windows":
        try:
            result = subprocess.run(
                ["tasklist", "/FI", "IMAGENAME eq chrome.exe", "/NH"],
                capture_output=True,
                text=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/repair_chrome_gemini.py (reported line 56)May include surrounding context.

python

if system == "darwin":
        for pattern in ("Google Chrome", "chrome", "Chromium"):
            try:
                result = subprocess.run(
                    ["pgrep", "-f", pattern],
                    capture_output=True,
                    text=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/repair_chrome_gemini.py (reported line 71)May include surrounding context.

python

if system == "darwin":
        for pattern in ("Google Chrome", "chrome", "Chromium"):
            try:
                result = subprocess.run(
                    ["pgrep", "-f", pattern],
                    capture_output=True,
                    text=True,

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script defaults to rewriting Chrome Local State language settings to en-US and also sets region/eligibility-related fields to US values, which silently alters user configuration to bypass product availability controls. In the context of a skill explicitly designed to enable Gemini outside the US, this behavior is more dangerous because it intentionally modifies eligibility and locale state without explicit opt-in for each change, creating policy circumvention and user-impact risk.

Content

No source excerpt is available for this finding.