Gemini Ops

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:20 AM UTC
• Version: 1.0.0

Overview

This skill is purpose-built to refresh Gemini MCP auth, but it handles reusable Google session cookies and delegates key actions to unaudited local scripts.

Review this before installing if you are comfortable letting the skill reuse a logged-in Chromium profile, extract Gemini/Google session cookies, and store them for mcporter. Use it only on a trusted single-user machine, restrict permissions on ~/.mcporter/mcporter.json and the delegated scripts, and avoid installing if you need audited, packaged behavior or official OAuth-style authentication.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T07 · Tool Hijacking and Spoofing

Warning

• Location: scripts/gemini-on.sh:3
• Finding: Execution of Unverified Scripts Outside the Audited Skill Boundary## Vulnerability Details **File Location**: `scripts/gemini-on.sh:3`, `scripts/gemini-off.sh:3`, and `scripts/gemini-status.sh:3-4` **Vulnerability Type**: Unverified delegation to mutable external tools **Risk Level**: Medium ### Vulnerable Code `scripts/gemini-on.sh:1-3`: ```bash #!/usr/bin/env bash set -euo pipefail /home/moltuser/clawd/scripts/gemini-on.sh ``` `scripts/gemini-off.sh:1-3`: ```bash #!/usr/bin/env bash set -euo pipefail /home/moltuser/clawd/scripts/gemini-off.sh ``` `scripts/gemini-status.sh:1-4`: ```bash #!/usr/bin/env bash set -euo pipefail cd /home/moltuser/clawd/skills/gemini-mcp ./scripts/gemini-status.sh ``` ### Technical Analysis These wrappers execute scripts located outside the audited project. The external implementations were not included in the supplied artifact, so their content, ownership, permissions, and integrity cannot be verified by this audit. This creates a trust-boundary weakness: a legitimate-looking invocation of the packaged Skill may execute different logic after review if one of the referenced external files is replaced or modified. No checksum, trusted-owner validation, restrictive-permission check, or other integrity control is performed before execution. The ON workflow is especially sensitive because `SKILL.md` states that its delegated implementation accesses Chromium through the Chrome DevTools Protocol, extracts the Google session cookies `__Secure-1PSID` and `__Secure-1PSIDTS`, and writes them to `~/.mcporter/mcporter.json`. Therefore, a compromised external implementation could operate in a credential-bearing context. The audited wrappers are not themselves evidence that the referenced scripts are currently malicious. The vulnerability is that runtime behavior depends on mutable, unaudited tools without integrity validation. ### Attack Path 1. An attacker obtains write access to one of the externally referenced scripts or to a parent di ...[truncated 1699 chars]
• Remediation: ## Remediation Suggestions 1. Package the actual ON, OFF, and status implementations inside this Skill so that all executable behavior is included in the reviewed artifact. 2. Resolve bundled scripts relative to the wrapper's own canonical directory rather than through mutable absolute paths. For example: ```bash SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)" exec "$SCRIPT_DIR/internal/gemini-on-impl.sh" ``` 3. If external delegation is operationally required: - Resolve and verify the canonical target path before execution. - Require the script and all relevant parent directories to be owned by an explicitly trusted account. - Reject files or directories writable by group members or other users. - Verify each target against a pinned cryptographic digest or authenticated manifest. - Invoke the validated absolute path with `exec` after all checks pass. 4. Apply restrictive permissions to scripts that handle authentication material, such as owner-only write permissions. 5. Separate cookie extraction from general operational scripts and grant only the minimum filesystem and browser access required. 6. Avoid delegating status checks to a sibling Skill directory unless that dependency is explicitly versioned, audited, and integrity-pinned. 7. Ensure session cookies and MCP configuration are never printed to logs or command output, and restrict `~/.mcporter/mcporter.json` to the owning user.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly instructs extraction of sensitive Google session cookies and storage of them in a local configuration file, but provides no warning about the credential sensitivity, storage protections, or abuse potential. These cookies can function as bearer credentials for Gemini/Google session access, so exposing or mishandling them could enable account takeover or unauthorized API use.

Session Persistence

Medium

• Category: Rogue Agent

Content

2. Navigate the **current tab** to `https://gemini.google.com/`.
3. Wait for load.
4. Extract `__Secure-1PSID` and `__Secure-1PSIDTS` from the Gemini tab via CDP `Network.getCookies`.
5. Write cookies to `~/.mcporter/mcporter.json` (`mcpServers.gemini.env`).
6. Run sanity check with `gemini.gemini_chat`.

## Turn Gemini OFF

• Confidence: 97% confidence
• Finding: Writing `__Secure-1PSID` and `__Secure-1PSIDTS` into `~/.mcporter/mcporter.json` creates deliberate session persistence of highly sensitive authentication material in a likely plaintext local file. If that file is read by another local user, malware, backups, logs, or misconfigured tooling, an attacker may be able to reuse the cookies to impersonate the user and access Gemini-associated services.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: The prompt literal `Ответь ровно: smoke-ok` instructs the model in Russian, imposing a specific language/locale choice in the skill behavior. The file does not offer any user language selection or document a justified region-specific constraint, which matches the natural-language locale policy violation criteria.