Home / All Skills / Content & Media Creation / baoyu-danger-gemini-web
English (EN)简体中文 (ZH)日本語 (JA)
Content & Media Creation · JimLiu/baoyu-skills

baoyu-danger-gemini-web

Generates images and text via reverse-engineered Gemini Web API. Supports text generation, image generation from prompts, reference images for vision input, and multi-turn conversations. Use when other skills need image generation backend, or when user requests "generate image with Gemini", "Gemini text generation", or needs vision-capable AI generation.

L5 Restricted · Isolated sandbox & strict auditV2 Human-AuditedReverse APITerms / ComplianceCredential / SessionExecute CommandNetwork AccessWrite FileDual-pass Audit
Author JimLiuGitHub JimLiu/baoyu-skills ↗Stars 25926License MIT（仓库根 LICENSE，Copyright (c) 2026 Jim Liu；GitHub API license.spdx_id=MIT）Commit 1567581c26
Control levels describe skill capabilities and suggested control measures; they do not represent quality or safety certifications, nor do they dictate usability. Usage decisions rest entirely with users and administrators. Different agent hosts apply varying constraints; do not assume hosts provide automatic protection. Third-party skill copyrights belong to their original authors. Use at your own risk.

1How It Works & Mechanism

The implementation is based on a custom-written Gemini Web client (TypeScript port of the open-source gemini_webapi), treating web-based private APIs as an SDK—which enables generating text and images without an official API Key.

skills/baoyu-danger-gemini-web/SKILL.md
| `scripts/gemini-webapi/*` | TypeScript port of `gemini_webapi` (GeminiClient, types, utils) |
The script directory includes a 513-line CLI (main.ts) + approximately 2,100 lines of library code (client/constants/types/utils), making it the skill with the largest codebase in the baoyu repository.

Endpoints are concentrated in constants.ts: INIT retrieves the page token, GENERATE uses the StreamGenerate private endpoint, ROTATE_COOKIES rotates session cookies, UPLOAD sends reference images, and BATCH_EXEC routes through batchexecute.

skills/baoyu-danger-gemini-web/scripts/gemini-webapi/constants.ts
'https://gemini.google.com/_/BardChatUi/data/assistant.lamda.BardFrontendService/StreamGenerate',
The same file also hardcodes the x-goog-ext-525001261-jspb header fingerprints for three models (including magic strings such as 9d8ca3786ebdfbea), effectively replicating the web version's model selection parameters.

The first step of authentication is fetching the SNlM0e access token from the webpage: performs a GET to gemini.google.com/app, extracts it from HTML via regex, and includes it in all subsequent generation requests.

skills/baoyu-danger-gemini-web/scripts/gemini-webapi/utils/get-access-token.ts
const m = text.match(/\"SNlM0e\":\"(.*?)\"/);
The token value is stored as this.access_token and sent alongside cookie headers; if not found, it throws 'Missing SNlM0e in response'.

Credentials originate from browser session cookies (__Secure-1PSID / __Secure-1PSIDTS): it first attempts to read a local cookie file, falling back to reading cookies from a browser via CDP, and by default reuses an already running local Chrome debugging session.

skills/baoyu-danger-gemini-web/scripts/gemini-webapi/utils/load-browser-cookies.ts
const existingCookies = hasExplicitProfile ? null : await fetch_cookies_from_existing_chrome(30_000, verbose);
SKILL.md also documents this behavior: when no explicit profile is specified, it may reuse an 'already running local Chrome/Chromium debugging session'; once retrieved, the filtered cookies are persisted to disk (write_cookie_file(..., 'cdp-existing')).

Cookies and tokens are persisted: cookies.json stores __Secure-1PSID/1PSIDTS, etc., and a background scheduled task refreshes 1PSIDTS via RotateCookies and writes it back to disk.

skills/baoyu-danger-gemini-web/scripts/gemini-webapi/client.ts
this.cookies['__Secure-1PSIDTS'] = newTs;
The refresh loop defaults to every 540 seconds (refresh_interval), calling write_cookie_file(..., 'refresh') after each update; the file path is determined by resolveGeminiWebCookiePath() in paths.ts (defaulting to cookies.json in the data directory, overridable via GEMINI_WEB_COOKIE_PATH).

Generation requests are form-encoded POSTs: the body carries at (access token) and f.req (nested JSON array), and the response is chunked streaming text from the web version that must be unpacked to extract the main content.

skills/baoyu-danger-gemini-web/scripts/gemini-webapi/client.ts
const body = new URLSearchParams({ at: this.access_token, 'f.req': f_req }).toString();
Parse failures branch on error codes: 1037 for quota exhaustion, 1050 for model mismatch with history, 1052 for invalid model header, and 1060 for temporary IP block (prompts user to use a proxy).

Multi-turn conversations are implemented by saving Gemini chat metadata into local session files: --sessionId reuses the same metadata to continue conversations, and message history is also recorded in JSON.

skills/baoyu-danger-gemini-web/SKILL.md
Session files stored in data directory under `sessions/<id>.json`.
main.ts pushes user/assistant messages and invokes saveSession; --list-sessions lists the 100 most recent sessions sorted by update time (displaying the first line of the last message as preview).

Using the reverse-engineered interface explicitly requires upfront consent: first-time use requires writing consent.json (accepted + disclaimerVersion 1.0), exiting immediately if declined.

skills/baoyu-danger-gemini-web/SKILL.md
1. Check if consent file exists with `accepted: true` and `disclaimerVersion: "1.0"`
The consent file is stored at ~/Library/Application Support or ~/.local/share under baoyu-skills/gemini-web/consent.json (uses %APPDATA% on Windows).

It also serves as an image backend: --image generates images (defaulting to generated.png), --reference/--ref provides vision input, and --promptfiles reads prompts from files, positioning it within the repo as an exceptional 'self-as-backend' skill.

docs/image-generation-tools.md
Skills that **are themselves** image-generation backends — currently `baoyu-image-gen`, `baoyu-image-gen` (deprecated), and `baoyu-danger-gemini-web` — do NOT include a `## Image Generation Tools` section.
Images are written to disk via save() in types/image.ts (writeFile(dest, buf)); image generation uses the same StreamGenerate channel, subsequently parsing image candidates from the response and downloading them.

2Core Capabilities

01Text generation (multi-model: gemini-3-pro default / flash / flash-thinking / 3.1-pro-preview)
02Image generation (--image, prompt sourced from argument/file/stdin)
03Vision input (--reference/--ref reference images)
04Multi-turn conversation (--sessionId + local session file + --list-sessions)
05Automated cookie lifecycle management (initial browser login, CDP extraction, background 1PSIDTS rotation, forced refresh via --login)
06Proxy support (HTTP_PROXY/HTTPS_PROXY for accessing Google from restricted networks)
07Consent gate (consent.json accepted + disclaimerVersion validation, halts on refusal)
08Image generation backend for other skills (explicitly documented as a 'self-as-backend' exception)

3External Dependencies

KindDependency / Endpoint
networkgemini.google.com（INIT 页面 + StreamGenerate 私有接口 + batchexecute）
networkaccounts.google.com（RotateCookies 轮换 1PSIDTS）
networkwww.google.com（基础页/常量）
networkcontent-push.googleapis.com（参考图上传）
packagebaoyu-chrome-cdp ^0.1.1（npm，用于发现/启动/接管 Chrome 调试会话并读 cookie）
clibun / npx（${BUN_X} 运行时）
cli本机 Chrome/Chromium/Edge 可执行文件（CDP 取 cookie；路径可由 GEMINI_WEB_CHROME_PATH 覆盖）

4Recommended Governance & Evidence

Suggested Controls for Safe Operation
For Agent Runtime
Isolated environment, per-use explicit authorization
For Administrators
Strict authorization, full audit, compliance signoff
Evidence & Triggers (File Paths & Excerpts)
  • SKILL.md / 脚本: Calls undocumented or reverse-engineered private APIs / spoofs client identity
  • SKILL.md / 脚本参数: Bypasses automation detection, disables host sandboxes, or skips SSL certificate verification
  • SKILL.md / 会话存储: Reads or reuses browser user login states and session cookies
  • 本地凭据 / 浏览器配置: Reads user login cookies/sessions/keyrings: browser session cookies: __Secure-1PSID / __Secure-1PSIDTS (from local cookies.json or via CDP Network)
  • scripts/: Executes local scripts or commands: scripts/main.ts (run with bun; launches or attaches to Chrome debugging sessions on demand)
  • 网络端点: Declares external network access: https://gemini.google.com/app (INIT to retrieve SNlM0e token)
  • 本地工作目录: File I/O and artifact output: cookies.json (credential persistence: writes __Secure-1PSID/1PSIDTS)
Audit Notes: (Classified at the capability/policy level, not a malicious implant). (a) Reverse-engineered private API + web client spoofing: directly calls gemini.google.com StreamGenerate/BardChatUi private endpoints, extracts SNlM0e tokens from HTML, and spoofs web client model selection via static x-goog-ext-525001261-jspb headers—not an official API. (b) Credential surface: reads and uses browser session cookies __Secure-1PSID / __Secure-1PSIDTS; when no explicit profile is provided, attaches via CDP to an 'already running local Chrome/Chromium debugging session' (using Network.getCookies to extract live login state), persisting filtered cookies and background-rotated 1PSIDTS to cookies.json / .cached_1psidts_*.txt. (c) Command surface: launches/attaches to browser processes (baoyu-chrome-cdp) and maintains an automated background refresh loop making persistent requests to accounts.google.com. Carries risk of account restrictions (README states 'Account restrictions possible if API usage detected'; codebase contains an IP_TEMPORARILY_BLOCKED handling branch). Severity note: No TLS verification downgrading, no anti-automation detection evasion techniques (no navigator.webdriver patching / patchright / headless evasion), no bulk targeted scraping, and no arbitrary code execution—the risk rating is based strictly on 'reverse-engineered private API + private credentials + local browser session takeover', not stealth techniques.

5Second-Pass Verification

  • [ok] 逆向 API 而非官方 API（red 主因之一） — constants.ts 直指 gemini.google.com 的 StreamGenerate 私有路径；get-access-token.ts 用正则从页面抓 SNlM0e；SKILL.md/description 自述 reverse-engineered，README 有 Disclaimer 段落。
  • [ok] 读取浏览器 cookie（red 主因之二） — load-browser-cookies.ts 走 CDP（引用 'Network.getCookies'）读 cookie；get-access-token.ts 优先本地 cookie 文件，失败回落 CDP；client.ts 在 init/refresh 两处写 cookie 文件。
  • [ok] CDP 复用已运行 Chrome 调试会话 — SKILL.md 原文与 load-browser-cookies.ts 的 fetch_cookies_from_existing_chrome(30_000, ...) 一致；另有 hasExplicitProfile 判断（设了 --profile-dir 或 GEMINI_WEB_CHROME_PROFILE_DIR 才跳过复用）。
  • [ok] token 落盘 — cookie-file.ts write_cookie_file → writeFile(p, JSON.stringify(payload, null, 2))；rotate-1psidts.ts 另写 .cached_1psidts_<sid>.txt。paths.ts 默认数据目录可用 GEMINI_WEB_DATA_DIR/GEMINI_WEB_COOKIE_PATH 覆盖。
  • [ok] 无 TLS 降级 / 无 stealth 反检测 / 无任意代码执行 — grep rejectUnauthorized / NODE_TLS / --ignore-certificate 与 webdriver / patchright / blink-features 均零命中；无 eval/new Function/远程脚本加载；Chrome 以本机真实 profile 启动（--remote-debugging-port），未做指纹伪装。
  • [ok] consent 门禁存在但为“软门禁” — SKILL.md 要求先建 consent.json 再使用；但门禁由 agent 按文档执行，脚本自身不校验该文件——属文档级约束，已在 risks 写明。
  • [ok] meta 元数据 — GitHub API：MIT、25926 stars、pushed_at 2026-09-10T15:13:43Z；本地 HEAD 与 pin 1567581c26ec… 一致。

6Verdict & Scenarios

  • Zero official key required: requires only a one-time browser login, subsequently generating text and images using cached session cookies, eliminating API application and billing costs.
  • Comprehensive capability coverage: combines text, image, vision reference images, multi-turn conversations, four model tiers, and proxy routing in a single CLI.
  • Automated cookie lifecycle: rotates 1PSIDTS in the background with browser-based fallback on failure, far more durable than manual cookie-pasting approaches.
  • Can serve as a free image generation backend for other skills (explicitly documented in the repo as a 'self-as-backend' exception).
  • Features a consent gate and informative error code prompts (explicit messages for quota limits, model mismatches, and IP bans), establishing clear terms for informed usage.
    • Best for: Ideal for individual developers handling experimental or low-sensitivity tasks: generating images or querying long-context text with Gemini without an official API key, tasks requiring vision inputs and multi-turn conversations, or serving as an image backend for other baoyu skills (with willingness to accept account and stability risks).
    Not for: Not suitable for enterprise production, confidential data processing, scenarios requiring stable SLAs or compliance audits; not suitable for high-frequency use on primary personal accounts; not suitable for environments lacking Chrome/Chromium without the ability to install browser dependencies.
    Install Agent-Ready
    ① Verified Mirror 2026-09-15
    Option A · Direct DownloadDownload baoyu-danger-gemini-web.tar.gz
    sha256: 076923f8aed80181…
    Option B · Copy Guide for Agent
    install.json
    Agents automatically download and verify mirrors from this JSON guide.
    ② Upstream GitHub
    GitHub Repo ↗
    Pinned to commit 1567581c26.