Enable Chrome Gemini

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:17 AM UTC
• Version: 1.0.0

Overview

This skill openly modifies Chrome profile state to force-enable Gemini outside normal regional eligibility, so users should review it before installing.

Install only if you deliberately want a tool that edits Chrome's Local State to make Gemini/Glic appear eligible, including changing region fields to US and, by default, Chrome language fields to en-US. Run --dry-run first, close Chrome before writing, keep the generated backup, and avoid using it on managed or primary profiles if unsupported-region behavior or language changes could cause problems.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/repair_chrome_gemini.py:133
• Finding: Chrome Gemini Regional and Eligibility Controls Can Be Overridden<![CDATA[ ## Vulnerability Details **File Location**: `scripts/repair_chrome_gemini.py`, lines 133–169 **Vulnerability Type**: Regional and feature-eligibility control bypass **Risk Level**: Medium ### Vulnerable Code ```python if data.get("variations_country") != "us": changes.append(f"variations_country: {data.get('variations_country')!r} -> 'us'") data["variations_country"] = "us" current_perm = data.get("variations_permanent_consistency_country") updated_perm = normalize_country_list(current_perm, "us") if updated_perm != current_perm: changes.append( "variations_permanent_consistency_country: " f"{current_perm!r} -> {updated_perm!r}" ) data["variations_permanent_consistency_country"] = updated_perm for key in ( "variations_safe_seed_permanent_consistency_country", "variations_safe_seed_session_consistency_country", ): if data.get(key) != "us": changes.append(f"{key}: {data.get(key)!r} -> 'us'") data[key] = "us" glic = data.get("glic") if not isinstance(glic, dict): changes.append("glic: created missing object") glic = {} data["glic"] = glic if glic.get("is_glic_eligible") is not True: changes.append(f"glic.is_glic_eligible: {glic.get('is_glic_eligible')!r} -> True") glic["is_glic_eligible"] = True browser = data.get("browser") if not isinstance(browser, dict): changes.append("browser.enabled_labs_experiments: created missing object") browser = {} data["browser"] = browser experiments = ensure_list(browser.get("enabled_labs_experiments")) added = [] for entry in ("glic@1", "glic-side-panel@1"): if entry not in experiments: experiments.append(entry) added.append(entry) ``` ### Technical Analysis The script directly rewrites Chrome's locally stored country and feature-eligibility state. It changes multiple variation-country properties to `us`, sets `glic.is_glic_eligible` to `True`, and adds the Glic experiments to the enabled experime ...[truncated 2390 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the automatic rewriting of all variation-country and Glic eligibility fields. 2. Use official Chrome configuration interfaces and documented feature-availability mechanisms rather than altering internal eligibility state. 3. Restrict repair behavior to restoring valid user preferences without representing the user as being in a different country. 4. If the override capability must remain for testing or diagnostics: - Require an explicit option such as `--override-eligibility`. - Display a clear warning that the operation changes internal regional and eligibility controls. - Require interactive confirmation unless a separately named noninteractive testing option is supplied. - Limit the operation to disposable test profiles rather than the user's primary profile. - Record the original values in a structured restoration manifest. - Provide a dedicated rollback command that verifies and restores the exact original values. 5. Detect managed Chrome installations before writing and refuse modification when enterprise policies govern the relevant settings. 6. Validate that the requested user-data directory belongs to the expected current-user profile and reject symbolic-link or unexpected-file targets before replacement. 7. Preserve `--dry-run` as the default recommended mode and show every affected eligibility field before accepting a write. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill clearly directs execution of a Python script that reads and writes Chrome profile data and relies on shell execution, but the manifest does not declare any tool scope or permissions. That omission weakens reviewability and containment because consumers cannot easily tell that filesystem and command execution are required before using the skill.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The workflow instructs users to alter Chrome's eligibility, region, and locale state to force-enable Gemini outside its normal availability, but it does not prominently warn about side effects. This can mislead users into changing browser behavior, account-facing region signals, or unsupported feature states without informed consent, increasing the chance of breakage or policy/terms conflicts.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The skill normalizes Chrome language settings to en-US as part of the default patch flow rather than making it an explicit, informed choice. Forced locale changes can affect UI language, content negotiation, and user expectations across browsing sessions, making this an unsafe default for a profile-level repair tool.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The default prompt auto-invokes the skill for broadly phrased requests to 'set up Gemini in Chrome automatically' and to repair multiple symptoms, without clearly limiting when the skill should engage or requiring confirmation before making system/browser changes. In context, this is risky because the skill appears capable of modifying Chrome state, region, flags, and language settings across operating systems, so ambiguous activation can lead to unintended configuration changes.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The default prompt explicitly includes 'region and language normalization,' which indicates the skill may alter user locale-related settings without a separate, informed opt-in. In this skill's context, that is more dangerous because changing browser language or regional eligibility fields can affect user experience, policy/compliance posture, and service behavior beyond the narrow goal of troubleshooting Gemini availability.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if system == "windows":
        try:
            result = subprocess.run(
                ["tasklist", "/FI", "IMAGENAME eq chrome.exe", "/NH"],
                capture_output=True,
                text=True,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if system == "darwin":
        for pattern in ("Google Chrome", "chrome", "Chromium"):
            try:
                result = subprocess.run(
                    ["pgrep", "-f", pattern],
                    capture_output=True,
                    text=True,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if system == "darwin":
        for pattern in ("Google Chrome", "chrome", "Chromium"):
            try:
                result = subprocess.run(
                    ["pgrep", "-f", pattern],
                    capture_output=True,
                    text=True,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The script defaults to rewriting Chrome Local State language settings to en-US and also sets region/eligibility-related fields to US values, which silently alters user configuration to bypass product availability controls. In the context of a skill explicitly designed to enable Gemini outside the US, this behavior is more dangerous because it intentionally modifies eligibility and locale state without explicit opt-in for each change, creating policy circumvention and user-impact risk.

Static analysis

No suspicious patterns detected.