Google Photos

• Outcome: Pass
• Latest audit: Jun 4, 2026 at 11:25 AM UTC
• Version:
  1.0.0

Overview

This is a disclosed Google Photos connector skill with sensitive read/write access, but its behavior is documented, scoped to the oo CLI, and includes confirmation guidance for changes.

Install only if you trust OOMOL and want to connect Google Photos through its oo CLI. Review the requested Google Photos scopes, confirm exact targets before uploads, album edits, or session deletion, and avoid using it for general Google Photos discussion when no account action is needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The skill declares it should be used for ANY Google Photos request and whenever a task involves Google Photos, which is an overly broad routing instruction. This can cause the agent to invoke the skill outside a narrowly scoped, least-privilege context and increases the chance of unnecessary access to read/write/delete operations, especially since the skill exposes destructive actions.

VirusTotal

64/64 vendors flagged this skill as clean.