Catalog
jimliu/baoyu-danger-gemini-web

jimliu

baoyu-danger-gemini-web

Generates images and text via reverse-engineered Gemini Web API. Supports text generation, image generation from prompts, reference images for vision input, and multi-turn conversations. Use when other skills need image generation backend, or when user requests "generate image with Gemini", "Gemini text generation", or needs vision-capable AI generation.

global
New~1.6k
v1.0Saved Jul 12, 2026

Gemini Web Client

Text/image generation via Gemini Web API. Supports reference images and multi-turn conversations.

User Input Tools

When this skill prompts the user, follow this tool-selection rule (priority order):

  1. Prefer built-in user-input tools exposed by the current agent runtime — e.g., AskUserQuestion, request_user_input, clarify, ask_user, or any equivalent.
  2. Fallback: if no such tool exists, emit a numbered plain-text message and ask the user to reply with the chosen number/answer for each question.
  3. Batching: if the tool supports multiple questions per call, combine all applicable questions into a single call; if only single-question, ask them one at a time in priority order.

Concrete AskUserQuestion references below are examples — substitute the local equivalent in other runtimes.

Script Directory

Important: All scripts are located in the scripts/ subdirectory of this skill.

Agent Execution Instructions:

  1. Determine this SKILL.md file's directory path as {baseDir}
  2. Script path = {baseDir}/scripts/<script-name>.ts
  3. Resolve ${BUN_X} runtime: if bun installed → bun; if npx available → npx -y bun; else suggest installing bun
  4. Replace all {baseDir} and ${BUN_X} in this document with actual values

Script Reference:

Script Purpose
scripts/main.ts CLI entry point for text/image generation
scripts/gemini-webapi/* TypeScript port of gemini_webapi (GeminiClient, types, utils)

Before first use, verify user consent for reverse-engineered API usage.

Consent file locations:

  • macOS: ~/Library/Application Support/baoyu-skills/gemini-web/consent.json
  • Linux: ~/.local/share/baoyu-skills/gemini-web/consent.json
  • Windows: %APPDATA%\baoyu-skills\gemini-web\consent.json

Flow:

  1. Check if consent file exists with accepted: true and disclaimerVersion: "1.0"
  2. If valid consent exists → print warning with acceptedAt date, proceed
  3. If no consent → show disclaimer, ask user via AskUserQuestion:
    • "Yes, I accept" → create consent file with ISO timestamp, proceed
    • "No, I decline" → output decline message, stop
  4. Consent file format: {"version":1,"accepted":true,"acceptedAt":"<ISO>","disclaimerVersion":"1.0"}

Preferences (EXTEND.md)

Check EXTEND.md in priority order — the first one found wins:

Priority Path Scope
1 .baoyu-skills/baoyu-danger-gemini-web/EXTEND.md Project
2 ${XDG_CONFIG_HOME:-$HOME/.config}/baoyu-skills/baoyu-danger-gemini-web/EXTEND.md XDG
3 $HOME/.baoyu-skills/baoyu-danger-gemini-web/EXTEND.md User home

If none found, use defaults.

EXTEND.md supports: Default model, proxy settings, custom data directory.

Usage

# Text generation
${BUN_X} {baseDir}/scripts/main.ts "Your prompt"
${BUN_X} {baseDir}/scripts/main.ts --prompt "Your prompt" --model gemini-3-flash

# Image generation
${BUN_X} {baseDir}/scripts/main.ts --prompt "A cute cat" --image cat.png
${BUN_X} {baseDir}/scripts/main.ts --promptfiles system.md content.md --image out.png

# Vision input (reference images)
${BUN_X} {baseDir}/scripts/main.ts --prompt "Describe this" --reference image.png
${BUN_X} {baseDir}/scripts/main.ts --prompt "Create variation" --reference a.png --image out.png

# Multi-turn conversation
${BUN_X} {baseDir}/scripts/main.ts "Remember: 42" --sessionId session-abc
${BUN_X} {baseDir}/scripts/main.ts "What number?" --sessionId session-abc

# JSON output
${BUN_X} {baseDir}/scripts/main.ts "Hello" --json

Options

Option Description
--prompt, -p Prompt text
--promptfiles Read prompt from files (concatenated)
--model, -m Model: gemini-3-pro (default), gemini-3-flash, gemini-3-flash-thinking, gemini-3.1-pro-preview
--image [path] Generate image (default: generated.png)
--reference, --ref Reference images for vision input
--sessionId Session ID for multi-turn conversation
--list-sessions List saved sessions
--json Output as JSON
--login Refresh cookies, then exit
--cookie-path Custom cookie file path
--profile-dir Chrome profile directory

Models

Model Description
gemini-3-pro Default, latest 3.0 Pro
gemini-3-flash Fast, lightweight 3.0 Flash
gemini-3-flash-thinking 3.0 Flash with thinking
gemini-3.1-pro-preview 3.1 Pro preview (empty header, auto-routed)

Authentication

First run opens browser for Google auth. Cookies cached automatically.

When no explicit profile dir is set, cookie refresh may reuse an already-running local Chrome/Chromium debugging session tied to a standard user-data dir. Set --profile-dir or GEMINI_WEB_CHROME_PROFILE_DIR to force a dedicated profile and skip existing-session reuse. This is a best-effort CDP session reuse path, not the Chrome DevTools MCP prompt-based --autoConnect flow described in Chrome's official docs.

Supported browsers (auto-detected): Chrome, Chrome Canary/Beta, Chromium, Edge.

Force refresh: --login flag. Override browser: GEMINI_WEB_CHROME_PATH env var.

Environment Variables

Variable Description
GEMINI_WEB_DATA_DIR Data directory
GEMINI_WEB_COOKIE_PATH Cookie file path
GEMINI_WEB_CHROME_PROFILE_DIR Chrome profile directory
GEMINI_WEB_CHROME_PATH Chrome executable path
HTTP_PROXY, HTTPS_PROXY Proxy for Google access (set inline with command)

Sessions

Session files stored in data directory under sessions/<id>.json.

Contains: id, metadata (Gemini chat state), messages array, timestamps.

Extension Support

Custom configurations via EXTEND.md. See Preferences section for paths and supported options.

Files28
28 files · 90.2 KB

Select a file to preview

Overall Score

72/100

Grade

B

Good

Safety

68

Quality

78

Clarity

75

Completeness

70

Summary

This skill provides a reverse-engineered Gemini Web API client for text and image generation, supporting multi-turn conversations and vision input. It wraps a TypeScript implementation of the Gemini API, handling authentication via browser-based cookie collection or cached credentials, and manages session state and cookie lifecycle.

Static Analysis Findings

1 finding

Patterns detected by deterministic static analysis before AI scoring. Hover over any finding code for detailed information and remediation guidance.

Credential Exposure
SEC-020Direct .env File Access17x in 4 files

Direct .env file access

scripts/main.ts.env3x
scripts/gemini-webapi/utils/get-access-token.ts.env2x
scripts/gemini-webapi/utils/load-browser-cookies.ts.env5x

Detected Capabilities

file readfile writeshell execution via execSyncbrowser automation via Chrome DevTools ProtocolHTTP requests to Google servicescookie/session managementenvironment variable read

Trigger Keywords

Phrases that MCP clients use to match this skill to user intent.

generate image with geminigemini text generationvision input analysismulti-turn conversationreverse-engineered apibrowser cookie authentication

Risk Signals

WARNING

Direct .env file access (resolveGeminiWebCookiePath, resolveGeminiWebDataDir read environment variables)

scripts/gemini-webapi/utils/paths.ts, scripts/gemini-webapi/utils/get-access-token.ts, scripts/gemini-webapi/utils/load-browser-cookies.ts, scripts/main.ts
WARNING

Browser automation via Chrome DevTools Protocol with user data directory access

scripts/gemini-webapi/utils/load-browser-cookies.ts
WARNING

Cookie file read/write to user home directory

scripts/gemini-webapi/utils/cookie-file.ts, scripts/gemini-webapi/utils/get-access-token.ts
INFO

HTTP requests to Google services (accounts.google.com, gemini.google.com, content-push.googleapis.com)

scripts/gemini-webapi/constants.ts, scripts/gemini-webapi/utils/get-access-token.ts
INFO

execSync for WSL home directory detection

scripts/gemini-webapi/utils/paths.ts:getWslWindowsHome

Referenced Domains

External domains referenced in skill content, detected by static analysis.

accounts.google.comcontent-push.googleapis.comgemini.google.comgithub.comlh3.googleusercontent.comwww.google.com

Use Cases

  • .get_access_token
  • Agents needing image generation backend without paid API
  • Applications requiring Gemini Web interface access bypassing OAuth flows
  • Multi-turn conversational AI with persistent session state
  • Vision-capable image analysis using reference photos
  • Batch text/image generation workflows

Quality Notes

  • Strong documentation of CLI options, models, and authentication flow
  • Clear error handling with custom exception classes (AuthError, APIError, ImageGenerationError, TimeoutError)
  • Session management implemented with metadata normalization and persistent storage
  • Comprehensive response parsing with fallback detection for generated images
  • Browser automation includes graceful Chrome lifecycle management (launch, reuse, kill)
  • Environment variable overrides documented (GEMINI_WEB_DATA_DIR, GEMINI_WEB_COOKIE_PATH, GEMINI_WEB_CHROME_PATH)
  • Type-safe TypeScript throughout with proper validation of nested JSON responses
  • Consent file requirement explicitly documented before first use
  • Preferences system (EXTEND.md) documented for custom configuration
  • Multi-format output support (text, JSON, image file save)
  • Missing explicit guardrails on Chrome profile directory isolation
  • No documented limits on conversation/session storage size
Model: claude-haiku-4-5-20251001Analyzed: Jul 12, 2026

Reviews

Add this skill to your library to leave a review.

No reviews yet

Be the first to share your experience.

Use jimliu/baoyu-danger-gemini-web in your dev environment

Command Palette

Search for a command to run...

jimliu/baoyu-danger-gemini-web | SkillRepo