Google Photos Manager for OpenClaw

Manage Google Photos library. Upload photos, create albums, and list library content. Use when the user wants to backup, organize, or share images via Google Photos.

Security Scan

The skill's code and instructions match its stated purpose (Google Photos management); no obvious attempts to exfiltrate data or contact unexpected endpoints were found, though there are some operational and minor security considerations to review before use.

Purpose & Capability

Name, description, SKILL.md, and the included Python script all align: they enable listing albums, creating albums, and uploading photos via the Google Photos Library API (photoslibrary.googleapis.com). The requested OAuth flow and use of credentials.json/token files are consistent with this purpose.

Instruction Scope

SKILL.md instructs running the included script and storing OAuth credentials/tokens locally — consistent with the task. It does not ask the agent to read unrelated system files or external endpoints. Minor scope issues: SKILL.md asserts a local Python virtualenv but provides no install/setup steps for dependencies, and it doesn't declare the expected token filename in the registry metadata (the script uses token_photos.pickle by default).

Install Mechanism

This is instruction-only (no install spec). The script imports google-auth and related libraries but the skill provides no pip/installation instructions. Operationally this means users must install dependencies themselves; not inherently dangerous but could cause confusion.

Credentials

The skill requests no environment variables or cloud credentials in registry metadata (none are required). Instead it relies on local OAuth credential files (credentials.json and a token pickle). That is proportional to the stated purpose, but users must not accept third-party token pickle files because pickle deserialization is unsafe if the file is maliciously modified.

Persistence & Privilege

The skill does not request permanent inclusion (always not set) and does not require extra privileges. It runs interactively and requires user action to authorize the OAuth flow, so it cannot silently obtain credentials without user involvement.

Assessment

This skill appears to do what it says (manage Google Photos) and only contacts Google Photos endpoints. Before installing or running it: 1) Use your own Google Cloud OAuth client credentials (do not use credentials supplied by others). 2) Inspect the script locally — it stores OAuth tokens as a pickle file (token_photos.pickle); do not load token files provided by untrusted sources because pickle deserialization can execute code. 3) Install required Python libraries in a controlled virtualenv (the script's shebang points to an absolute venv path which may be invalid — replace it or run with your Python). 4) Confirm you are comfortable storing credentials.json and the token file on the local filesystem and follow Google best practices. 5) If you need non-interactive use, add explicit installation steps and locking of token storage; otherwise run interactively so you control authorization. If you want, I can produce a checklist or a small README with safe install and usage commands (pip install requirements, how to create OAuth client, how to run) before you proceed.

Google Photos

This skill provides a way to interact with Google Photos Library API to automate photo management.

Setup

1. Enable API: Enable the "Google Photos Library API" in your Google Cloud Console project.
2. Credentials: Download your OAuth 2.0 Client ID credentials as credentials.json.
3. Environment: This skill uses a Python virtual environment located in its folder.

Usage

All commands are run through the scripts/gphotos.py script.

List Albums

Useful for finding the ID of an existing album.

./scripts/gphotos.py --action list --credentials /path/to/credentials.json --token /path/to/token.pickle

Create a New Album

./scripts/gphotos.py --action create --title "Vacations 2026" --credentials /path/to/credentials.json --token /path/to/token.pickle

Upload a Photo

You can optionally specify an --album-id to add the photo to a specific album.

./scripts/gphotos.py --action upload --photo "/path/to/image.jpg" --album-id "ALBUM_ID" --credentials /path/to/credentials.json --token /path/to/token.pickle

Privacy & Security

• This skill only has access to photos it uploads or that are explicitly shared with the application.
• Credentials and tokens are stored locally and should be kept secure.
• Never share your credentials.json or token.pickle files.