Gemini Web Automation Skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:04 AM UTC
• Version: 0.1.0

Overview

The skill is intended to automate Gemini web chats, but it relies on unaudited runtime scripts and can reuse an authenticated browser session while sending prompts or files to Gemini.

Install only if you are comfortable with an agent using an authenticated Gemini web session, launching or reusing Chrome in the background, and sending your prompts plus any specified files/images to Gemini. Review or provide the missing runtime scripts before use, and avoid sending sensitive files unless the workflow adds an explicit confirmation step.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md

chat.py
  │
  ├── Stage 1: 环境
  │   ├── .env 不存在 → ENV_NOT_FOUND
  │   ├── userdata/ 不存在 → 自动创建
  │   └── 代理不可达 → PROXY_REQUIRED
  │

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger description uses broad phrases like '帮我问 Gemini' and '用 Gemini 回答', which can cause the skill to activate for loosely related requests. In this skill's context, accidental invocation is meaningful because it can launch a browser session, reuse an authenticated Gemini session, and potentially transmit user content to a third-party web service without a clearly bounded intent check.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description says the skill can upload images or files to Gemini, but it does not provide a clear privacy warning that such content will be sent to an external service. In this context, the omission is significant because users may supply sensitive local files or screenshots, leading to unintended data exfiltration to Gemini under an authenticated account.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill describes automatic runtime handling that includes starting Chrome, reusing existing tabs/sessions, and interacting with Gemini in the background, but it does not prominently warn the operator or user about these side effects. That lack of transparency is dangerous because users may unknowingly trigger actions in an authenticated browser context, creating privacy, consent, and data-handling risks.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

整个技能说明以中文固定表述运行方式与交互预期，但没有说明这是面向特定中文用户群、也没有提供语言选择或用户 opt-in。若组织要求避免默认强制单一语言，这会构成自然语言层面的 locale 策略问题。

Content

No source excerpt is available for this finding.