skillZs
★ LIVE SKILL TAGS ★
>>> LIVE SKILLS INDEX <<<
* OPEN SOURCE *
NO LOGIN, NO TRACKING
※ REAL INSTALL DATA ※
← back to all skills
freestylefly/canghe-skills492 installs

canghe-danger-gemini-web

Generates images and text via reverse-engineered Gemini Web API. Supports text generation, image generation from prompts, reference images for vision input, and multi-turn conversations. Use when other skills need image generation backend, or when user requests "generate image with Gemini", "Gemini text generation", or needs vision-capable AI generation.

How do I install this agent skill?

npx skills add https://github.com/freestylefly/canghe-skills --skill canghe-danger-gemini-web
view source ↗

Is this agent skill safe to install?

  • Gen Agent Trust Hubfail

    This skill uses a reverse-engineered Gemini Web API that hijacks the user's local web browser to extract sensitive authentication credentials. It utilizes Chrome DevTools Protocol (CDP) to launch a browser instance, attach to a Google session, and harvest authentication cookies (__Secure-1PSID, __Secure-1PSIDTS), which are then cached locally in a hidden directory. This technique bypasses standard authentication boundaries and poses a high risk of credential harvesting.

  • Socketwarn

    5 alerts: gptAnomaly, gptSecurity

  • Snykpass

    Risk: LOW · No issues

  • Runlayerwarn

    24/25 files flagged

What does this agent skill do?

Gemini Web Client

Text/image generation via Gemini Web API. Supports reference images and multi-turn conversations.

Script Directory

Important: All scripts are located in the scripts/ subdirectory of this skill.

Agent Execution Instructions:

  1. Determine this SKILL.md file's directory path as SKILL_DIR
  2. Script path = ${SKILL_DIR}/scripts/<script-name>.ts
  3. Replace all ${SKILL_DIR} in this document with the actual path

Script Reference:

ScriptPurpose
scripts/main.tsCLI entry point for text/image generation
scripts/gemini-webapi/*TypeScript port of gemini_webapi (GeminiClient, types, utils)

Consent Check (REQUIRED)

Before first use, verify user consent for reverse-engineered API usage.

Consent file locations:

  • macOS: ~/Library/Application Support/canghe-skills/gemini-web/consent.json
  • Linux: ~/.local/share/canghe-skills/gemini-web/consent.json
  • Windows: %APPDATA%\canghe-skills\gemini-web\consent.json

Flow:

  1. Check if consent file exists with accepted: true and disclaimerVersion: "1.0"
  2. If valid consent exists → print warning with acceptedAt date, proceed
  3. If no consent → show disclaimer, ask user via AskUserQuestion:
    • "Yes, I accept" → create consent file with ISO timestamp, proceed
    • "No, I decline" → output decline message, stop
  4. Consent file format: {"version":1,"accepted":true,"acceptedAt":"<ISO>","disclaimerVersion":"1.0"}

Preferences (EXTEND.md)

Use Bash to check EXTEND.md existence (priority order):

# Check project-level first
test -f .canghe-skills/canghe-danger-gemini-web/EXTEND.md && echo "project"

# Then user-level (cross-platform: $HOME works on macOS/Linux/WSL)
test -f "$HOME/.canghe-skills/canghe-danger-gemini-web/EXTEND.md" && echo "user"

┌──────────────────────────────────────────────────────────┬───────────────────┐ │ Path │ Location │ ├──────────────────────────────────────────────────────────┼───────────────────┤ │ .canghe-skills/canghe-danger-gemini-web/EXTEND.md │ Project directory │ ├──────────────────────────────────────────────────────────┼───────────────────┤ │ $HOME/.canghe-skills/canghe-danger-gemini-web/EXTEND.md │ User home │ └──────────────────────────────────────────────────────────┴───────────────────┘

┌───────────┬───────────────────────────────────────────────────────────────────────────┐ │ Result │ Action │ ├───────────┼───────────────────────────────────────────────────────────────────────────┤ │ Found │ Read, parse, apply settings │ ├───────────┼───────────────────────────────────────────────────────────────────────────┤ │ Not found │ Use defaults │ └───────────┴───────────────────────────────────────────────────────────────────────────┘

EXTEND.md Supports: Default model | Proxy settings | Custom data directory

Usage

# Text generation
npx -y bun ${SKILL_DIR}/scripts/main.ts "Your prompt"
npx -y bun ${SKILL_DIR}/scripts/main.ts --prompt "Your prompt" --model gemini-2.5-pro

# Image generation
npx -y bun ${SKILL_DIR}/scripts/main.ts --prompt "A cute cat" --image cat.png
npx -y bun ${SKILL_DIR}/scripts/main.ts --promptfiles system.md content.md --image out.png

# Vision input (reference images)
npx -y bun ${SKILL_DIR}/scripts/main.ts --prompt "Describe this" --reference image.png
npx -y bun ${SKILL_DIR}/scripts/main.ts --prompt "Create variation" --reference a.png --image out.png

# Multi-turn conversation
npx -y bun ${SKILL_DIR}/scripts/main.ts "Remember: 42" --sessionId session-abc
npx -y bun ${SKILL_DIR}/scripts/main.ts "What number?" --sessionId session-abc

# JSON output
npx -y bun ${SKILL_DIR}/scripts/main.ts "Hello" --json

Options

OptionDescription
--prompt, -pPrompt text
--promptfilesRead prompt from files (concatenated)
--model, -mModel: gemini-3-pro (default), gemini-2.5-pro, gemini-2.5-flash
--image [path]Generate image (default: generated.png)
--reference, --refReference images for vision input
--sessionIdSession ID for multi-turn conversation
--list-sessionsList saved sessions
--jsonOutput as JSON
--loginRefresh cookies, then exit
--cookie-pathCustom cookie file path
--profile-dirChrome profile directory

Models

ModelDescription
gemini-3-proDefault, latest
gemini-2.5-proPrevious pro
gemini-2.5-flashFast, lightweight

Authentication

First run opens browser for Google auth. Cookies cached automatically.

Supported browsers (auto-detected): Chrome, Chrome Canary/Beta, Chromium, Edge.

Force refresh: --login flag. Override browser: GEMINI_WEB_CHROME_PATH env var.

Environment Variables

VariableDescription
GEMINI_WEB_DATA_DIRData directory
GEMINI_WEB_COOKIE_PATHCookie file path
GEMINI_WEB_CHROME_PROFILE_DIRChrome profile directory
GEMINI_WEB_CHROME_PATHChrome executable path
HTTP_PROXY, HTTPS_PROXYProxy for Google access (set inline with command)

Sessions

Session files stored in data directory under sessions/<id>.json.

Contains: id, metadata (Gemini chat state), messages array, timestamps.

Extension Support

Custom configurations via EXTEND.md. See Preferences section for paths and supported options.

Add the canonical catalog link to the repository README so users can inspect current installs and available audits. The publishing guide covers the complete discovery path.

<a href="https://skillzs.dev/skills/freestylefly/canghe-skills/canghe-danger-gemini-web">View canghe-danger-gemini-web on skillZs</a>