ClawHub
Back to skill

Security audit

dropbox-business

Security checks for vulnerabilities and agentic risk

Overview

This is a powerful Dropbox Business admin skill, but its sensitive capabilities are disclosed, purpose-aligned, and repeatedly gated on explicit user approval.

Install only if you intend to grant a trusted Maton connection Dropbox Business admin access. Use the least-privileged Dropbox admin account and scopes available, confirm exact resource IDs before writes or deletes, avoid member-file access unless there is a clear business justification, and review/delete any functions, triggers, or destinations that create ongoing automation or forwarding.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The Dropbox Business manifest says the shared trigger-reference files 'add no Dropbox Business capability' and should only be treated as generic platform reference text, but this file explicitly documents concrete GitHub event types, parameters, and payloads that can be used when a user has connected GitHub. That creates a direct documentation-level contradiction inside the skill package: the manifest frames these files as non-capability-widening background material, while the file itself is actionable integration guidance for a different source.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.