Is Auto Flow x G-Labs Automation safe?
We analyzed Auto Flow x G-Labs Automation version 10.8.58's actual code and gave it a 58/100 trust score. Useful for Google Flow automation, but its…
Bottom line
Useful for Google Flow automation, but its exposed session bridge creates a serious security concern.
What it can access
It can automate Google Flow, download results, and read Flow session material; access is site-limited but the session capability is powerful.[Q1][Q3][Q4][Q21]
Security weaknesses
Scripts running on Flow pages can impersonate bridge requests and obtain session or CAPTCHA material because the requester is not authenticated.[Q21]
Signs of misuse
It sends prompts and media to Google for generation and shares licensing details plus a persistent install ID with its service; unrelated browsing collection was not found.[Q6][Q13][Q14]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
Its permissions support the advertised Google Flow automation, but they are powerful: Flow-page access, Identity email, downloads, alarms, and unlimited local storage. Access is site-limited rather than global.
Requests storage, unlimitedStorage, alarms, downloads, downloads.open, identity, identity.email, and hosts limited to Flow, G-Labs, and Google APIs. — manifest.json:permissions/host_permissions
Uses the Flow access to create projects and submit image, video, voice, and reference-media jobs. — assets/adapter-DVGc3ohE.js:Q.buildSubmit/Q.submit
Which websites can it run on, and can it read or change what appears on those pages?
The page access runs only on flow.google.com. There it can read page state, inject an overlay and page-world bridge, automate Flow requests, and navigate the tab to project pages.
Registers the content script only on https://flow.google.com/*. — manifest.json:content_scripts.matches
Adds the automation overlay, executes queued jobs, reports status, and can navigate to a Flow project page. — assets/index.ts-BE9ngO_v.js:overlay/run engine
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
It processes prompts, dialogue, reference images or video, and the signed-in Flow email when those automation features are used. It does not contain a general keylogger or password-field collector.
Builds Google Flow requests containing user prompts, dialogue, images, video references, characters, and model settings. — assets/adapter-DVGc3ohE.js:buildSubmit/submit
Searches the Flow page HTML for the signed-in email and reads session values from WIZ_global_data. — src/content/mainworld-bridge.js:scrapeEmail/flowAuth
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It reads Flow's signed-in session values and account email from the page and can create downloads. It does not request Chrome's cookies, history, or bookmarks permissions.
Returns the Flow at, bl, and sid session values plus a scraped account email. — src/content/mainworld-bridge.js:flowAuth
Uses chrome.downloads.download and optionally chrome.downloads.open for generated results. — assets/index.ts-BYmyxMFg.js:result download handling
Does not request cookies, history, or bookmarks. — manifest.json:permissions
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It can save and open downloaded files and use Chrome Identity to obtain the browser-profile email. It has no camera, microphone, location, native-messaging, management, or broad file-system permission.
Includes downloads, downloads.open, identity, and identity.email, but none of the other listed device capabilities. — manifest.json:permissions
Uses Chrome Identity OAuth or profile information to obtain the user's Google email. — assets/naming-Bysx_Vg_.js:Google sign-in/ProfileUserInfo
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
Prompts, reference media, CAPTCHA tokens, and session-backed requests go to Google Flow. G-Labs receives email, installation ID, license token or Google access token, nonces, and app identity for licensing; no prompt or generated-media upload to G-Labs was found.
Submits prompts and reference media to Flow endpoints selected from the signed remote configuration. — assets/adapter-DVGc3ohE.js:Flow RPC and upload functions
Posts account and license metadata to https://glab.duckmartians.info. — assets/naming-Bysx_Vg_.js:login/checkLicense/logout/upgradePrice
Fetches version and notification information from the G-Labs /info endpoint. — assets/index.ts-BYmyxMFg.js:ie
Does it download or run code, settings, or instructions supplied by a remote server?
The G-Labs server supplies signed or encrypted feature configuration, tier limits, pricing, Flow services paths, RPC identifiers, and notices. The package does not download JavaScript or turn those settings into code.
Verifies signed license responses and can decrypt rc_enc configuration using the local license token. — assets/naming-Bysx_Vg_.js:verify/checkLicense
Remote configuration supplies Flow origin, paths, CAPTCHA actions, RPC IDs, and model mappings used by packaged request code. — assets/adapter-DVGc3ohE.js:Ir configuration class
No downloaded script, dynamic import URL, or response-to-code execution path was found. — assets/window-BrL14dYz.js:complete bundle review
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
During a user-started run it can silently open or focus Flow tabs, create a hidden Flow /about tab to mint CAPTCHA tokens, send repeated generation requests, and download completed results automatically.
Creates or focuses Flow tabs and closes the temporary hidden CAPTCHA tab after use. — assets/index.ts-BYmyxMFg.js:Flow tab/mint-on-about handlers
Downloads result URLs when automation reports completed jobs. — assets/index.ts-BYmyxMFg.js:engine-event result handling
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Requests none of the browser-settings or management permissions. — manifest.json:permissions
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
Most logic is in large minified production bundles, which materially slows review. Module boundaries and descriptive strings remain visible, and the critical page bridge is shipped as readable source.
The main UI is a roughly 487 KB one-line minified bundle with framework and compatibility code. — assets/window-BrL14dYz.js:entire file
The security-sensitive page-world bridge is readable, commented JavaScript. — src/content/mainworld-bridge.js:entire file
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Contains the standard Function('return this') compatibility fallback, not execution of server-controlled code. — assets/window-BrL14dYz.js:core-js global fallback
Uses ordinary functions and timers and contains no eval, Function constructor, or string timer. — src/content/mainworld-bridge.js:complete source review
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
No all-sites or general browsing access is requested. — manifest.json:content_scripts.matches
License telemetry contains account, install, and app identifiers rather than browsing history. — assets/naming-Bysx_Vg_.js:license request bodies
Does it create a persistent ID or browser fingerprint to recognize you?
It creates a random installation ID that persists in local storage and sends it to G-Labs as a hardware ID during login and recurring license checks.
Creates and retains a crypto.randomUUID installation identifier. — assets/index.ts-BYmyxMFg.js:jt/af_install_id
Sends that value as hwid along with the account and app identity. — assets/naming-Bysx_Vg_.js:login/checkLicense/logout
Does it send cookies, session details, authentication data, or page contents elsewhere?
Flow session values and page content are sent back to Google Flow to perform generation requests. G-Labs receives the user's email and license or Google OAuth credential during sign-in, but the reviewed paths do not send Flow session values, prompts, or media to G-Labs.
Reads at, bl, sid, and email from the signed-in Flow page. — src/content/mainworld-bridge.js:flowAuth
Uses the Flow session values to authenticate Google batchexecute requests. — assets/adapter-DVGc3ohE.js:br/rn.call
May send a Google access token and email to G-Labs to establish the extension license session. — assets/naming-Bysx_Vg_.js:login
Does it record typing, form entries, clipboard contents, or screenshots?
It reads prompts and other task form values entered in its own control window and reads the Flow page's email/session state. No keystroke logger, clipboard monitor, or screenshot capture was found.
Collects user-entered prompts, dialogue, model choices, and selected reference files for queued generation. — assets/window-BrL14dYz.js:task editor and run preparation
Does not request clipboardRead, desktopCapture, or tabCapture. — manifest.json:permissions
Can a website or remote server send commands that make the extension take actions?
Remote configuration controls supported models, limits, Flow request paths, RPC IDs, payment details, notices, and minimum versions. Separately, any script already running in the Flow page can invoke the public page bridge to request Flow session or CAPTCHA values.
Loads signed server configuration and tier limits used throughout the app. — assets/naming-Bysx_Vg_.js:checkLicense/rc_enc
Accepts any same-window message bearing AF_MW_REQ; it has no per-install secret or authenticated sender. — src/content/mainworld-bridge.js:message listener
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
DOM work implements only the Flow automation overlay and job engine. — assets/index.ts-BE9ngO_v.js:complete content bundle review
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
It does not intercept arbitrary web traffic or alter request headers globally, but it does initiate authenticated Flow requests and creates Chrome downloads for completed generation jobs.
Has downloads permissions but no declarativeNetRequest, webRequest, or proxy permission. — manifest.json:permissions
Calls chrome.downloads.download for HTTPS or generated data-image result URLs. — assets/index.ts-BYmyxMFg.js:download result handling
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Contains no nativeMessaging permission or localhost/private-network host pattern. — manifest.json:permissions/host_permissions
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
AES-GCM decryption produces a JSON configuration object consumed as models, limits, pricing, and endpoint settings. — assets/naming-Bysx_Vg_.js:G/rc_enc
No path from remote configuration to eval, Function, dynamic import, or script text was found. — assets/window-BrL14dYz.js:dangerous-sink review
Can ordinary websites access privileged extension features through messaging or exposed files?
Only Flow pages can load the exposed bridge, but scripts already executing in that page can impersonate the page access's AF_MW_REQ messages and read the AF_MW_RES reply containing Flow session or CAPTCHA material.
Exposes the bridge and automation modules only to https://flow.google.com/*. — manifest.json:web_accessible_resources
Checks same window and origin, which page scripts satisfy, but does not authenticate the requester. — src/content/mainworld-bridge.js:window message listener
Uses a predictable public request/response marker and numeric correlation ID over window.postMessage. — assets/adapter-DVGc3ohE.js:ot/yr
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Binds signed responses to email, install ID, and nonce, then returns plan, limits, and remote configuration. — assets/naming-Bysx_Vg_.js:checkLicense/verify
Uses server values for capabilities, update requirements, pricing, and notifications. — assets/index.ts-BYmyxMFg.js:remote config and /info handling
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Repeated work polls Google Flow jobs and optionally processes requested generated media. — assets/adapter-DVGc3ohE.js:polling/media functions
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
No form action rewrite, generic input replacement, or submit interception appears. — assets/index.ts-BE9ngO_v.js:complete content bundle review
Form-like controls belong to the extension's own task editor and payment interface. — assets/window-BrL14dYz.js:extension UI