Security audit
Security checks for vulnerabilities and agentic risk
This skill performs sensitive Gemini login, upload, and download automation, but those behaviors are disclosed, purpose-aligned, and not hidden or persistent.
Install only if you are comfortable letting an agent use a managed browser session for Gemini, upload user-provided files to Google's Gemini web service, and use already-provided Google login and TOTP secrets. Keep MFA secrets in a controlled location, avoid pasting them into chat, and review files before upload.
The declared description frames the skill as generic Gemini web interaction, but the documented behavior includes credential handling, TOTP generation, parsing otpauth URIs, and reading secrets from environment variables or JSON files. This mismatch can prevent users and reviewers from recognizing that the skill performs sensitive authentication operations and accesses high-value secrets.
The skill declares capabilities to read environment variables, local files, and interact with a third-party web service, but does not constrain or document tool scope via explicit permissions. In a skill that handles credentials, TOTP secrets, uploads local files, and downloads outputs, missing scope declarations increases the chance of over-broad access and unintended data exposure.
The skill supports uploading local documents and images to Gemini for analysis without clearly warning that those files will be transmitted to Google's online service. This can lead to unintended disclosure of sensitive local data, especially because the workflow encourages uploading source materials as context for analysis.
The skill automates login to a third-party Google/Gemini web service using stored credentials and generated TOTP codes, but does not clearly warn about the security and privacy implications of using account secrets in browser automation. If misused, this could expose credentials, session state, or account access through logs, screenshots, browser compromise, or unintended automation behavior.
The script is a credential-handling utility that can load TOTP secrets from arbitrary environment variables or JSON files, which expands the attack surface for sensitive secret access inside an automation skill whose stated purpose is browser interaction. In an agent context, this can normalize reading MFA material from local runtime state or arbitrary files, increasing the risk of unintended credential exposure, misuse, or secret harvesting if the skill is invoked with attacker-influenced inputs.
The natural-language instructions and examples are presented exclusively in Chinese, which effectively forces a specific language for users of the skill. There is no indication that the language choice is optional or that the skill is intended only for a Chinese-language audience.
The skill downloads, moves, and renames Gemini outputs on local disk without clearly warning users that files will be written to and modified in local directories. While lower severity than credential or upload issues, silent filesystem writes can still surprise users, overwrite expectations, or place sensitive generated content in persistent storage.
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
digest_name = algorithm.lower()
try:
digest = getattr(hashlib, digest_name)
except AttributeError as exc:
raise ValueError(f"unsupported algorithm: {algorithm}") from exc
The script accepts highly sensitive MFA seeds from environment variables and files but provides no user-facing warning, confirmation, or safe-handling guidance. In an automation setting, this can cause operators to pass secrets through insecure channels or store them in casually accessible files, increasing the chance of accidental disclosure even if the script itself does not exfiltrate them.
No suspicious patterns detected.