google-photos-takeout-pipeline

• Outcome: Review
• Latest audit: Aug 28, 2026 · 12:39 PM UTC
• Version: 1.0.2

Overview

The skill appears aimed at a real Google Takeout backup workflow, but it exports live Google session cookies and uses broad browser-debugging and local command authority that should be reviewed carefully before installation.

Install only if you are comfortable with a tool reading live Google session cookies from your browser and writing them to disk. Run it only on a trusted single-user machine, keep the Chrome remote-debugging port local, delete the cookie jar and any saved Takeout URL immediately after use, avoid shared /tmp or backed-up paths, and do not let an agent populate --linux-browser-cmd from untrusted input.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"--remote-debugging-port=9222",
                        "--no-first-run", "--no-default-browser-check"])
    else:
        subprocess.run(linux_cmd or "chromium --remote-debugging-port=9222 --no-first-run",
                       shell=True)
    for _ in range(10):
        time.sleep(3)

• Confidence: 98% confidence
• Finding: The script executes a user-controllable string via subprocess.run(..., shell=True), which creates a command injection path through --linux-browser-cmd. An attacker who can influence that parameter can execute arbitrary shell commands with the privileges of the user running the script.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

for z in candidates:
                name = os.path.basename(z)
                t0 = time.time()
                r = subprocess.run(["unzip", "-t", "-qq", z], capture_output=True, text=True)
                if r.returncode != 0:
                    log(f"  {name}: INTEGRITAET FEHLGESCHLAGEN (rc={r.returncode}) — bleibt liegen")
                    continue

• Confidence: 89% confidence
• Finding: Although `subprocess.run` is used safely without a shell, the script passes attacker-controlled ZIP paths to the external `unzip` utility. Processing untrusted archives can expose the host to archive parsing issues or decompression bombs, causing resource exhaustion or triggering vulnerabilities in the external tool.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if r.returncode != 0:
                    log(f"  {name}: INTEGRITAET FEHLGESCHLAGEN (rc={r.returncode}) — bleibt liegen")
                    continue
                r = subprocess.run(["nice", "-n", "15", "unzip", "-o", "-qq", z, "-d", args.dest],
                                   capture_output=True, text=True)
                if r.returncode != 0:
                    log(f"  {name}: entpacken fehlgeschlagen (rc={r.returncode}) — bleibt liegen")

• Confidence: 98% confidence
• Finding: The extraction step feeds untrusted ZIP archives directly to `unzip` and writes their contents into a destination directory without validating member paths. A malicious archive may exploit Zip Slip-style path traversal or symlink handling to overwrite files outside `args.dest`, and can also consume excessive disk space during extraction.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 97% confidence
• Finding: The skill clearly performs sensitive operations—reading browser-derived cookies, writing cookie jars and downloaded archives, invoking shell tools, and making authenticated network requests—yet it declares no permissions. That omission weakens user consent and platform policy enforcement, especially because the documented workflow accesses live session credentials from a browser debugging interface.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 84% confidence
• Finding: The skill description advertises an official Google Photos to iCloud server-side transfer, but the document indicates that flow is only documented in references rather than implemented. This is not directly exploitable like code execution or credential theft, but it is a trust and transparency problem because users may grant broad access expecting capabilities or safeguards that do not actually exist.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The security model claims cookie reads are filtered to Google domains, but earlier sections explicitly instruct harvesting all browser cookies via CDP using Storage.getCookies. That discrepancy is dangerous because browser-level cookie collection can expose unrelated sessions if filtering is done after retrieval or implemented incorrectly, and the misleading documentation reduces user awareness of the real credential exposure.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The quick-start guides users to extract live Google session cookies and reuse them for automated downloads, but it does not foreground that these cookies are effectively bearer credentials for a logged-in account. Without prominent warnings, users may leave the cookie jar on disk, expose it through backups or shared temp directories, or underestimate the account takeover risk if it is stolen.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The function extracts authenticated browser cookies for Google domains directly from a live Chrome debugging session and returns them as a reusable Cookie header string. In the context of a bulk-download pipeline explicitly advertising cookie harvesting, this enables session hijacking or unauthorized access to Google account resources if the value is logged, reused, or exfiltrated, and there is no user consent prompt, scoping control, or safeguard around sensitive credential access.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The script extracts a live Google Takeout download URL from the browser's downloads page and can persist it to any user-specified file without warning, redaction, or permission checks. In this skill's context, that URL is likely a bearer-style, time-limited link to sensitive archive data, so writing it to disk can expose access through shell history, shared workspaces, backups, or overly broad file permissions.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The script extracts live browser cookies via the Chrome DevTools Protocol and writes them to a local Netscape cookie jar, effectively exporting authenticated session credentials. Even though it filters to Google-related domains and sets mode 0600, these cookies can still enable account/session hijacking for Google services if the file or CDP access is abused.

Ssd 3

High

• Confidence: 99% confidence
• Finding: These instructions direct automated harvesting and reuse of session cookies from a logged-in browser to access protected Takeout downloads. Session cookies are bearer tokens; if intercepted, mishandled, or repurposed, they can grant unauthorized access to account data without passwords or MFA prompts.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The workflow repeatedly refreshes cookies from the browser before every archive part, which operationalizes continuous session-token reuse over a long-running automation job. This increases the attack window and creates repeated opportunities for leakage through logs, temporary files, process inspection, backups, or compromise of the local host.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The security model explicitly authorizes reading Google and Googleusercontent cookies from the user's browser and writing them to a local cookie jar for authenticated reuse. Even if intended for a legitimate backup workflow, this is a high-risk credential-handling pattern because stolen or exposed session cookies can enable unauthorized access to sensitive account resources.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

"--remote-debugging-port=9222",
                        "--no-first-run", "--no-default-browser-check"])
    else:
        subprocess.run(linux_cmd or "chromium --remote-debugging-port=9222 --no-first-run",
                       shell=True)
    for _ in range(10):
        time.sleep(3)

• Confidence: 99% confidence
• Finding: This is a true tool parameter abuse issue because the script forwards the --linux-browser-cmd parameter directly into a shell command. In the context of an automation skill, this is especially dangerous because agents or wrappers may populate parameters dynamically, making arbitrary command execution more likely if inputs are not tightly controlled.

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match

Content

to Takeout automation (Takeout itself is cookie-gated). The scripts are built to touch
the minimum:

- **Reads:** cookies via the local Chrome DevTools Protocol (localhost:9222) of YOUR
  browser, filtered to `*.google.com` / `*.googleusercontent.com` domains only —
  cookies of banks, shops and other services never leave the browser.
- **Writes:** a Netscape cookie jar (chmod 600) in `/tmp` (or `--jar` path), used only

• Confidence: 93% confidence
• Finding: The information-stealer signature is triggered for a valid reason: the skill extracts browser session cookies via Chrome DevTools Protocol and persists them for later authenticated requests. Although the apparent purpose is backup automation rather than overt malware, the behavior overlaps strongly with credential-theft tradecraft and would be highly damaging if adapted, misused, or run on an untrusted host.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.