Home / All Skills / Content & Media Creation / canghe-danger-gemini-web
English (EN)简体中文 (ZH)日本語 (JA)
Content & Media Creation · freestylefly/canghe-skills

canghe-danger-gemini-web

Generates images and text via reverse-engineered Gemini Web API. Supports text generation, image generation from prompts, reference images for vision input, and multi-turn conversations. Use when other skills need image generation backend, or when user requests "generate image with Gemini", "Gemini text generation", or needs vision-capable AI generation.

L5 Restricted · Isolated sandbox & strict auditV2 Human-AuditedReverse APITerms / ComplianceCredential / SessionExecute CommandNetwork AccessWrite FileDual-pass Audit
Author freestyleflyGitHub freestylefly/canghe-skills ↗License MIT（仓库根 LICENSE）Commit dd0bf35595
Control levels describe skill capabilities and suggested control measures; they do not represent quality or safety certifications, nor do they dictate usability. Usage decisions rest entirely with users and administrators. Different agent hosts apply varying constraints; do not assume hosts provide automatic protection. Third-party skill copyrights belong to their original authors. Use at your own risk.

1How It Works & Mechanism

The implementation foundation is a handwritten Gemini Web client: the open-source gemini_webapi is ported file-by-file into TypeScript (client/types/utils), enabling text and image generation without an official API key.

skills/canghe-danger-gemini-web/SKILL.md
| `scripts/gemini-webapi/*` | TypeScript port of `gemini_webapi` (GeminiClient, types, utils) |
What it does: The script directory contains 25 files in total (a 491-line main.ts CLI and the gemini-webapi library); capabilities originate from this self-maintained client rather than the official SDK.

Endpoints are centralized in constants.ts: INIT fetches the page token, StreamGenerate uses the private streaming endpoint, ROTATE_COOKIES rotates session cookies, UPLOAD uploads reference images, and BATCH_EXEC handles batchexecute.

skills/canghe-danger-gemini-web/scripts/gemini-webapi/constants.ts
'https://gemini.google.com/_/BardChatUi/data/assistant.lamda.BardFrontendService/StreamGenerate',
What it does: Solidifies the private endpoints actually used between the web frontend and backend into constants, routing all subsequent generation requests through these paths.

The first step of authentication is acquiring the access token: during init, get_access_token is called with existing cookies, throwing an error if a valid token cannot be obtained—all generation requests must carry it.

skills/canghe-danger-gemini-web/scripts/gemini-webapi/client.ts
const [token, valid] = await get_access_token(this.cookies, this.proxy, vb);
What it does: The token is stored in this.access_token; when missing, the client directly throws APIError('Missing access token.'), meaning it cannot operate without session credentials.

Credentials originate from browser session cookies: load-browser-cookies probes the local debugging port (/json/version, default 127.0.0.1) and spawns browser processes on demand to read the active login state.

skills/canghe-danger-gemini-web/scripts/gemini-webapi/utils/load-browser-cookies.ts
const res = await fetch_with_timeout(`http://127.0.0.1:${port}/json/version`, { timeout_ms: 5_000 });
What it does: Node connects directly to the local Chrome/Chromium/Edge debugging port to read Google domain cookies outside of x.com for use in requests.

Cookies and rotation results are persisted to local files: cookie-file writes to disk as JSON, and rotate-1psidts caches refreshed 1PSIDTS values to a file.

skills/canghe-danger-gemini-web/scripts/gemini-webapi/utils/cookie-file.ts
await writeFile(p, JSON.stringify(payload, null, 2), 'utf8');
What it does: Flushes filtered session cookies to cookies.json; rotate-1psidts.ts similarly writes new values to cachePath, effectively persisting account login states locally.

Image capabilities reside in types/image.ts: remote images are downloaded and written to disk (writeFile(dest, buf)), while reference images are routed through the content-push upload channel via upload-file.

skills/canghe-danger-gemini-web/scripts/gemini-webapi/types/image.ts
await writeFile(dest, buf);
What it does: Image bytes generated or fetched from the web are written directly to dest; upload_file sends a POST via FormData to Endpoint.UPLOAD to obtain a remote handle.

Multi-turn conversations do not rely on server-side sessions; instead, Gemini chat metadata is saved locally to sessions/<id>.json, using --sessionId to reuse metadata and continue dialogues.

skills/canghe-danger-gemini-web/SKILL.md
Session files stored in data directory under `sessions/<id>.json`.
What it does: Session states are managed entirely by the skill itself and persisted to disk; --list-sessions is used to list existing sessions.

Reverse-engineered usage explicitly requires 'prior consent': on first run, it must verify the consent file (accepted and disclaimerVersion 1.0), exiting immediately if declined.

skills/canghe-danger-gemini-web/SKILL.md
1. Check if consent file exists with `accepted: true` and `disclaimerVersion: "1.0"`
What it does: The gatekeeper logic is written into the SKILL.md flow and executed by the agent per documentation; the consent file is located at ~/.local/share/canghe-skills/gemini-web/consent.json (with platform-specific paths on macOS/Windows).

The request layer features a running retry decorator: it automatically calls init if the client is not initialized, and sleeps for 1s before retrying upon encountering an APIError if retries remain.

skills/canghe-danger-gemini-web/scripts/gemini-webapi/utils/decorators.ts
if (e instanceof APIError && r > 0) {
What it does: Uses a decorator to wrap outer public methods with 'ensure initialized + retry on failure', with stricter retry limits applied to image generation errors.

2Core Capabilities

01Text generation (three model tiers: gemini-3-pro default / gemini-2.5-pro / gemini-2.5-flash)
02Image generation (--image, default generated.png)
03Vision reference image input (--reference/--ref)
04Multi-turn conversations (--sessionId to reuse local session metadata + --list-sessions)
05Self-managed cookie lifecycle (initial browser login, automatic caching, --login forced refresh)
06Proxy support (HTTP_PROXY/HTTPS_PROXY for accessing Google in restricted network environments)
07Consent gatekeeping (validates accepted + disclaimerVersion in consent.json, halting immediately upon refusal)
08Usable as an image generation backend for other skills

3External Dependencies

KindDependency / Endpoint
networkgemini.google.com（INIT 页面取令牌 + StreamGenerate 私有生成接口 + batchexecute）
networkaccounts.google.com（RotateCookies 轮换会话 cookie）
networkcontent-push.googleapis.com（参考图上传）
networklh3.googleusercontent.com（返回图像资源 gg-dl）
clibun / npx（以 npx -y bun 直接运行脚本，无运行时抽象）
cli本机 Chrome/Chromium/Edge 可执行文件（按需 spawn 以读取会话 cookie）

4Recommended Governance & Evidence

Suggested Controls for Safe Operation
For Agent Runtime
Isolated environment, per-use explicit authorization
For Administrators
Strict authorization, full audit, compliance signoff
Evidence & Triggers (File Paths & Excerpts)
  • SKILL.md / 脚本: Calls undisclosed or reverse-engineered private APIs / forges client identification
  • SKILL.md / 脚本参数: Bypasses automated detection, disables host sandboxes, or skips SSL certificate verification
  • SKILL.md / 会话存储: Reads or reuses browser user login states and session cookies
  • 本地凭据 / 浏览器配置: Reads user login cookies/sessions/keyrings: browser session cookies: __Secure-1PSID / __Secure-1PSIDTS, etc. (local cookies.json or via local Chrome)
  • scripts/: Executes local scripts or commands: scripts/main.ts (run via npx -y bun; probes and spawns local browsers on demand to read cookies)
  • 网络端点: Declares external network access: https://gemini.google.com/app (INIT fetches page token)
  • 本地工作目录: File read/write and artifact output: cookies.json (credential persistence: writes session cookies)
Audit Notes: (Classified as a capability/policy-level finding, not malicious injection). (a) Reverse engineering + impersonating a web client: directly invokes private endpoints of gemini.google.com such as StreamGenerate/BardChatUi and accounts.google.com/RotateCookies, leveraging browser session cookies to impersonate a logged-in web client rather than using official APIs. (b) Credential handling: reads and uses browser session cookies (__Secure-1PSID/__Secure-1PSIDTS, etc.); load-browser-cookies.ts probes the local debugging port (/json/version) and spawns Chrome/Chromium/Edge to retrieve actual login states, persisting cookies to cookies.json and caching rotated 1PSIDTS values separately. Environment variables also allow overriding data directories/browser paths. (c) Command execution: the script spawns browser processes and includes automatic retries at the request layer. Severity clarification: no TLS downgrade or anti-automation spoofing (no webdriver patching/stealth) detected; no arbitrary code execution or bulk data scraping found. Classification is based on 'reverse-engineered private endpoints + private credentials + web session impersonation', not stealth techniques.

5Second-Pass Verification

  • [ok] 逆向 API 而非官方 API（red 主因之一） — constants.ts 直指 gemini.google.com 的 StreamGenerate 私有路径；SKILL.md/description 自述 reverse-engineered，并设 consent 门禁。
  • [ok] 读取浏览器会话 cookie（red 主因之二） — load-browser-cookies.ts 探测 127.0.0.1 调试端口并按需 spawn 浏览器；SKILL.md 自述 First run opens browser for Google auth。
  • [ok] 凭据落盘 — cookie-file.ts 的 writeFile(p, JSON.stringify(payload, null, 2)) 与 rotate-1psidts.ts 的 writeFile(cachePath, v) 两处写盘，路径由 paths.ts 解析。
  • [ok] 无 TLS 降级 / 无 stealth 伪装 / 无任意代码执行 — 相关行为在 bundle 正文与 §3 风险扫描中均零命中；调度只有 init 重试与 sleep。
  • [ok] consent 门禁存在但为“软门禁” — SKILL.md 要求先建 consent.json 再使用；但脚本自身不校验该文件，属文档级约束，已写入 risks。
  • [ok] 功能声明与实现相符 — 文本/图像/vision/多轮四项在 SKILL.md Options 与 main.ts/client.ts 均有对应实现，未见夸大。

6Verdict & Scenarios

  • Zero official API key required: generates text and images relying on cached session cookies after a single browser login, eliminating API applications and billing.
  • Comprehensive capabilities: text, images, vision reference inputs, multi-turn dialogues, three model tiers, and proxy routing all in one CLI.
  • Automated cookie lifecycle: persists cookies.json and separately rotates the 1PSIDTS cache, making it far more durable than manual cookie pasting.
  • Can serve as a free image backend for other skills (explicitly listed as 'image generation backend' in description).
  • Features a consent gatekeeper and clear disclaimer workflow, establishing explicit requirements for informed use.
    • Best for: Suitable for individual developers conducting experimental or low-sensitivity tasks: when an official API key is unavailable and Gemini is needed for image generation or long-form queries, when vision inputs and multi-turn conversations are required, or when acting as an image backend for other skills (must be willing to accept account and stability risks).
    Not for: Not suitable for enterprise production, processing confidential data, scenarios requiring stable SLAs or compliance audits; not suitable for high-frequency use on primary accounts; not suitable for environments lacking Chrome/Chromium without willingness to install browser dependencies.
    Install Agent-Ready
    ① Verified Mirror 2026-10-10
    Option A · Direct DownloadDownload canghe-danger-gemini-web.tar.gz
    sha256: a98a97c1f7c81879…
    Option B · Copy Guide for Agent
    install.json
    Agents automatically download and verify mirrors from this JSON guide.
    ② Upstream GitHub
    GitHub Repo ↗
    Pinned to commit dd0bf35595.