The Agent Skills Directory

[CREDENTIALS_UNSAFE] (HIGH): The skill programmatically extracts Google authentication cookies from the user's browser profiles. \n
Evidence: scripts/gemini-webapi/utils/load-browser-cookies.ts implements a Chrome DevTools Protocol (CDP) client to call Network.getCookies for the purpose of obtaining __Secure-1PSID and other session tokens. \n- [COMMAND_EXECUTION] (HIGH): The skill spawns browser processes with specific debugging flags that allow for programmatic control and session hijacking. \n
Evidence: scripts/gemini-webapi/utils/load-browser-cookies.ts uses child_process.spawn to launch browser binaries (Chrome, Edge, or Chromium) with the --remote-debugging-port and --user-data-dir flags. \n- [DATA_EXFILTRATION] (MEDIUM): The skill has the capability to read local files and transmit them to external endpoints. \n
Evidence: scripts/gemini-webapi/utils/upload-file.ts reads local file content using fs.promises.readFile and uploads it to https://content-push.googleapis.com/upload using the fetch API. \n- [PROMPT_INJECTION] (HIGH): The skill exhibits a significant indirect prompt injection surface due to high-privilege capabilities combined with untrusted data processing. \n
Ingestion points: Reads responses from the Gemini Web API (scripts/gemini-webapi/utils/parsing.ts) and processes local files as prompts (SKILL.md). \n
Boundary markers: No boundary markers or 'ignore embedded instructions' delimiters are used. \n
Capability inventory: Browser process spawning (scripts/gemini-webapi/utils/load-browser-cookies.ts), cookie extraction via CDP, local file read/write access, and network operations. \n
Sanitization: Only basic HTML entity decoding is performed on API outputs in scripts/gemini-webapi/types/candidate.ts.

baoyu-danger-gemini-web