Dropbox Kb Auto
ReviewAudited by ClawScan on May 10, 2026.
Overview
The skill appears aimed at Dropbox search, but it needs broad Dropbox read credentials and can automatically copy selected cloud documents into persistent agent memory with unclear effective scope controls.
Install only if you are comfortable granting read-only Dropbox file access and storing extracted document text in OpenClaw memory. Verify the actual folders in dropbox-sync.py before running, start with a small test folder, review any cron job created by the installer, and protect or revoke the Dropbox refresh token when needed.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If installed and configured, the skill can read Dropbox files within its configured scan scope and continue using the refresh token until it is revoked.
The skill requires a persistent Dropbox refresh token with read access to Dropbox file metadata and content. That access is central to the skill, but it is broad and the registry metadata says there is no primary credential or required environment variable.
Choose **Scoped access** → **Full Dropbox** ... Enable: `files.metadata.read`, `files.content.read` ... `DROPBOX_FULL_REFRESH_TOKEN=your_refresh_token`
Use the narrowest Dropbox app/access model possible, grant read-only permissions only, protect the .env file, and revoke the token if you stop using the skill.
Private Dropbox files may become searchable or reusable by the agent, and more folders than intended could be indexed if the effective configuration is not what the user expects.
The script stores extracted Dropbox content in persistent OpenClaw memory and shows hard-coded scan/skip paths. This conflicts with the documentation's config.json-based scoping, making it unclear whether user-edited scope controls are actually honored.
OUTPUT_DIR = OPENCLAW_HOME / "workspace/memory/knowledge/dropbox" FOLDERS = ["/Documents", "/Work", "/Research"] SKIP_PATHS = ["/Archive", "/Backups", "/Photos"]
Before running, inspect the actual dropbox-sync.py values, start with a narrow test folder, verify generated memory files, and manually remove the memory/progress/cursor files if you want to stop retaining indexed content.
Dropbox indexing can continue on a schedule after installation until the cron job is removed or disabled.
The installer can create a recurring background sync job. It is prompted and purpose-aligned, but it creates ongoing automated activity.
read -p "Create cron job for automatic syncing? [Y/n]: " create_cron ... openclaw cron create ... --message "cd $SCRIPT_DIR && python3 dropbox-sync.py"
Choose no during setup if you only want manual syncing, and review or delete the OpenClaw cron job when no longer needed.
Running setup changes the local system and depends on package repositories at install time.
The setup process installs system and Python dependencies without pinned versions. These installs are expected for OCR and document parsing, but they expand the trusted supply chain.
sudo apt-get update sudo apt-get install -y tesseract-ocr ... poppler-utils python3-pip ... pip3 install --user pypdf openpyxl python-pptx python-docx
Review the installer first, consider a virtual environment, pin package versions where possible, and avoid running privileged package installs unless you trust the sources.