Skills/PyPI/google-photos-mcp

google-photos-mcp@0.14.4

CAUTION· not started

Publisher claims: "MCP server for Google Photos libraries (search, view, albums) over the web app's private RPCs" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher benjamin-di · publishing for 25 daysInstalls 2,247Last detonated 34 min ago
What would fix thisWatchDispute verdict

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
install scripts, with decoy credentials in place · second launch with the clock 45 days ahead · the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
PHOTOS_LOGIN_TOKENPHOTOS_MAINTENANCE_CREDENTIAL_READER or --allow-credential-mintConfiguration, not credentials: CONNECTIONS_NATIVE_SCREENSHOT, CONNECTIONS_REQUIRE_CONTROLS, CONNECTIONS_SCREENSHOT, NOVNC_DIR, PHOTOS_CONDITIONAL_NATIVE_ACCOUNT, PHOTOS_CONNECTIONS_ACCOUNT, PHOTOS_CONNECTIONS_CONTROLS_DIR, PHOTOS_DEFAULT_LOGIN_PORT, PHOTOS_E2E_UNMANAGED, PHOTOS_LOGIN_NOVNC, PHOTOS_LOGIN_PROFILES, PHOTOS_LOGIN_SESSIONS, PHOTOS_LOGIN_UNMANAGED_BROWSER, PHOTOS_LOGIN_X11VNC, PHOTOS_LOGIN_XVFB, PHOTOS_STATE_DIR, PHOTOS_TEST_CHROME, POCKET_ID_BIN
Where it talks to
no vendor host named in the codeAlso google.com — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names google.com as well as its own vendor. The guard injects PHOTOS_LOGIN_TOKEN, PHOTOS_MAINTENANCE_CREDENTIAL_READER only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- uvx google-photos-mcp

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (3 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-15 and scored it 70/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Hex-encoded string detected; Hex-encoded string detected; Prompting user to enter sensitive credentials. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 3 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessinstall script run in the sandbox
0.0sprocessexec /usr/bin/dirname
0.0sprocessexited 127: ./scripts/bootstrap.sh: line 5: uv: command not found
0.2sprocessdependency install exit 1 ·
0.2sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.2sprocessscript backend runs setup only
0.2sprocesssecond launch, clock +45 days, CI unset
0.3sprocessexec /usr/bin/dirname
0.3sprocessexited 127: ./scripts/bootstrap.sh: line 5: uv: command not found

Static findings

MEDIUM
Python subprocess execution detectedsrc/photos_mcp/session_export.py:381 · Python subprocess execution detecteddone = subprocess.run(command, check=False)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/photos_login/keeper.py:164 · Python subprocess execution detecteddisplay = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Hex-encoded string detectedsrc/photos_mcp/upload.py:80 · Hex-encoded string detected — may contain obfuscated payloadsif head[:16] == b"\x30\x26\xb2\x75\x8e\x66\xcf\x11\xa6\xd9\x00\xaa\x00\x62\xce\x6c":Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Python subprocess execution detectedscripts/connections_e2e.py:167 · Python subprocess execution detectedprocess = subprocess.Popen([str(binary)], cwd=provider_dir, env=env, stdout=provider_log, stderr=provider_log)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandsrc/photos_mcp/deployment.py:373 · Process kill command — agent can terminate processes# The pinned stop_display clears handles even after a kill wait times out.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedscripts/source-identity.py:17 · Python subprocess execution detectedreturn subprocess.check_output(["git", *args], cwd=root)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File permission modification commandscripts/check-maintenance-image.sh:11 · File permission modification command — agent changes file ownership/permissionschmod -R a+rX "$deps"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Hex-encoded string detectedsrc/photos_mcp/upload.py:236 · Hex-encoded string detected — may contain obfuscated payloadsreturn b"\x08\x02\x10\x01\x18\x01\x20\x01\x38" + _varint(size) + b"\x40\x01"Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
CRITICAL
Prompting user to enter sensitive credentialssrc/photos_maintenance/definitions/google.toml:117 · Prompting user to enter sensitive credentials — social engineeringany_text = ["enter your password", "use your password"]Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
CRITICAL
Prompting user to enter sensitive credentialssrc/photos_maintenance/definitions/google.toml:64 · Prompting user to enter sensitive credentials — social engineering…fy')", "button:has-text('Other options')"] password_choice = ["button:has-text('Enter your password')", "div[role='link']:has-text('Enter your password')", "div[role='button']:has…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
MEDIUM
Python subprocess execution detectedscripts/check-build-identity.py:73 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File permission modification commandscripts/check-connections.sh:11 · File permission modification command — agent changes file ownership/permissionschmod 755 "$report"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Python subprocess execution detectedscripts/check-build-identity.py:56 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
LOW
HTML comment carrying imperative instructions to the agentsrc/photos_mcp/view.html:7 · HTML comment carrying imperative instructions to the agent · informational: not an instruction filephotos_show (MCP Apps, protocol 2026-01-26): the host loads this page in a sandboxed frame, answers ui/initialize, then sends the tool's input and result. The tFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01

Cost to the agent

Instructions loaded
≈63 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

Not checked against OSV yet; the weekly check has not reached this version.

What would make this Verified

10 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Prompting user to enter sensitive credentials≈ +9 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  2. Unclaimed publisher≈ +8 on the totalClaim benjamin-di: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  3. Hex-encoded string detected≈ +4 on the totalPut hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
  4. Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  5. Process kill command≈ +2 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  6. File permission modification command≈ +2 on the totalRequest the narrowest permission that works; replace wildcards with the exact paths or hosts.
Publish a new version to PyPI, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim benjamin-diPropose a patch to the maintainer