baoyu-danger-gemini-web

• Outcome: Review
• Latest audit: May 28, 2026 · 1:55 PM UTC
• Version: 1.56.1

Overview

This is a coherent unofficial Gemini Web client, but it needs user review because it can reuse Google browser sessions and store live session cookies locally.

Install only if you are comfortable with an unofficial Gemini Web client using and caching your Google browser session. Use a dedicated Chrome profile and custom data directory, avoid sending sensitive local files or private prompts, and delete stored cookies and session files when finished.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The invocation guidance is broad enough to match many generic requests for image generation or Gemini usage, increasing the chance the skill is selected automatically in contexts where the user did not intend browser-based auth, cookie reuse, or remote uploads. In a high-capability skill, overbroad triggers make accidental exposure more likely.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The authentication section describes reusing existing browser sessions and automatically caching cookies, but it does not present a prominent warning about the credential and privacy implications of accessing local browser state. Reusing a live Chrome debugging session or stored cookies can expose authenticated account data and may operate beyond what users reasonably expect from a generation skill.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The client persists highly sensitive Gemini authentication cookies (`__Secure-1PSID` / `__Secure-1PSIDTS`) to disk automatically. If the cookie file is readable by other local users, included in backups, synced to cloud storage, or later exposed by another bug, an attacker can reuse those cookies to impersonate the user and access the Gemini Web session.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The auto-refresh path rewrites refreshed authentication cookies to disk, extending the exposure window of valid credentials without any user-facing consent or warning. This increases the chance that long-lived, still-valid session material remains recoverable from local storage and can be stolen for account/session hijacking.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The method forwards caller-supplied cookies on arbitrary image download requests and manually follows redirects, which can send authenticated session material to attacker-controlled hosts if the URL or redirect chain is untrusted. In this skill context, the library interfaces with a reverse-engineered web API and downloads remote content, making SSRF-style exfiltration of Gemini/Google session cookies more plausible and increasing the sensitivity of the transmitted credentials.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The code persists Gemini Web authentication cookies to disk in plaintext JSON without any access-control hardening, encryption, or explicit safeguards. Because these cookies likely represent active session credentials for a reverse-engineered web API, any local user, malware, backup system, or accidental file disclosure could reuse them to hijack the account or abuse the authenticated session.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This code automatically loads Google cookies from the local browser via Chrome CDP and later persists working cookies to disk, including sensitive authentication material such as __Secure-1PSID and __Secure-1PSIDTS. Even if intended to help authenticate to Gemini Web, this behavior resembles credential harvesting because it accesses and stores session cookies without an explicit user-consent gate in this code path, increasing the risk of account/session compromise if the skill or host is abused.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This code extracts Google/Gemini session cookies from a running or launched Chrome instance through the Chrome DevTools Protocol and persists them to disk via write_cookie_file. Those cookies appear sufficient to authenticate requests to Gemini, so storing and reusing them creates a credential-harvesting and session-hijacking risk, especially because it can attach to an existing browser session without an explicit user-facing consent gate in this file.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code writes the refreshed `__Secure-1PSIDTS` authentication cookie to disk in a file named with the associated `__Secure-1PSID` value. Persisting live session cookies unencrypted increases the chance of credential theft through local compromise, backups, logs, multi-user access, or later accidental disclosure, and the filename itself also exposes sensitive token material. In this skill's context, these cookies appear to grant access to a reverse-engineered Gemini web session, so theft could enable account/session hijacking or misuse of the user's authenticated AI access.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This function reads an arbitrary local file path and uploads the file contents to a remote endpoint, but the code itself provides no consent gate, allowlist, or disclosure mechanism around that exfiltration step. In the context of an agent skill that can be invoked by other skills and handles user-supplied files, this increases the risk of unintended transmission of sensitive local data to a third-party service.

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match

Content

}
}

async function fetch_cookies_from_existing_chrome(
  timeoutMs: number,
  verbose: boolean,
): Promise<CookieMap | null> {

• Confidence: 98% confidence
• Finding: The flagged behavior matches an infostealer pattern because the function discovers a running Chrome debugging session, attaches to it, retrieves cookies for Google domains, and then later saves them for reuse. In the context of an agent skill, this is especially dangerous because it can silently appropriate an already authenticated user's browser session and convert it into a reusable application credential.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/gemini-webapi/utils/paths.ts:38