T09 · Insecure Skill Coding Practices
Error
- Location
dropbox-sync.py:261- Finding
Deleted Dropbox Documents Remain in Persistent Agent Memory
- Content
View full analysis
- Remediation
View remediation
Security audit
Dropbox Kb Auto
Security checks for vulnerabilities and agentic risk
Overview
The skill does what it claims, but it handles broad Dropbox content and persistent agent memory with enough scoping and retention problems that users should review it carefully before installing.
Install only if you are comfortable granting read access to the selected Dropbox areas and storing extracted copies in local OpenClaw memory. Prefer the narrowest Dropbox app scope possible, avoid sensitive or shared folders, review the hard-coded folder settings in dropbox-sync.py before manual use, secure ~/.openclaw/.env, and plan how to remove indexed Markdown files if Dropbox content is deleted or should no longer be searchable.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)
T02 · Agent Memory Poisoning
Error
- Location
dropbox-sync.py:319- Finding
Untrusted Dropbox Content Is Persisted Directly into Agent Memory
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
dropbox-sync.py:120- Finding
Predictable Shared OCR Temporary Paths Allow File Injection and Unsafe Deletion
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
dropbox-sync.py:17- Finding
Runtime Ignores Documented Configuration and May Index Unintended Files
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
setup.sh:44- Finding
Installer Retrieves and Installs Unpinned Python Dependencies
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Rogue AgentSelf-Modification, Session Persistence
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (23)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )" CONFIG_FILE="$SCRIPT_DIR/user-config.json" OPENCLAW_ENV="$HOME/.openclaw/.env" echo "╔════════════════════════════════════════════════╗" echo "║ Dropbox KB Auto - Interactive Setup ║"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )" CONFIG_FILE="$SCRIPT_DIR/user-config.json" OPENCLAW_ENV="$HOME/.openclaw/.env" echo "╔════════════════════════════════════════════════╗" echo "║ Dropbox KB Auto - Interactive Setup ║"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh echo "" echo "Next steps:" echo " 1. Create Dropbox app at https://www.dropbox.com/developers/apps" echo " 2. Copy credentials to ~/.openclaw/.env (see .env.example)" echo " 3. Edit config.json to customize folders" echo " 4. Run: python3 dropbox-sync.py"
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md ## Requirements - OpenClaw installed and running - Dropbox account with API access ([create app](https://www.dropbox.com/developers/apps)) - Linux or macOS (tested on Ubuntu 24.04, macOS 14+) ## Installation
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill description explains the technical behavior, but it does not prominently warn users that Dropbox file contents will be ingested into the agent’s knowledge base and then used to answer later prompts. That creates a meaningful privacy and data-governance risk because users may connect sensitive folders without realizing the content becomes searchable by the agent.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
System Dependencies
bash # Debian/Ubuntu sudo apt-get install -y tesseract-ocr tesseract-ocr-eng poppler-utils # macOS brew install tesseract poppler
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
System Dependencies
bash # Debian/Ubuntu sudo apt-get install -y tesseract-ocr tesseract-ocr-eng poppler-utils # macOS brew install tesseract poppler
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 89% confidence
- Finding
The skill instructs users to create a Full Dropbox scoped app and store a long-lived refresh token in a local environment file. Persistent credentials tied to broad Dropbox access increase the blast radius if the host, env file, backups, or logs are compromised, enabling ongoing access to potentially all Dropbox content.
- Content
md ### Dropbox App Setup 1. Create app at https://www.dropbox.com/developers/apps 2. Choose **Scoped access** → **Full Dropbox** 3. Enable: `files.metadata.read`, `files.content.read` 4. Generate refresh token via OAuth 2 flow
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python f"&client_secret={env['DROPBOX_FULL_APP_SECRET']}" ).encode() req = urllib.request.Request( "https://api.dropboxapi.com/oauth2/token", data=data, headers={"Content-Type": "application/x-www-form-urlencoded"} ) return json.loads(urllib.request.urlopen(req).read())["access_token"]
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python f"&client_secret={env['DROPBOX_FULL_APP_SECRET']}" ).encode() req = urllib.request.Request( "https://api.dropboxapi.com/oauth2/token", data=data, headers={"Content-Type": "application/x-www-form-urlencoded"} ) return json.loads(urllib.request.urlopen(req).read())["access_token"]
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 87% confidence
- Finding
This invokes external binaries on untrusted Dropbox-sourced PDF content after first rendering pages to images in a shared /tmp location. While shell injection is not present because arguments are passed as a list, parsing attacker-controlled documents with pdftoppm/tesseract increases exposure to parser bugs, resource exhaustion, and temp-file interference in a multi-user environment.
- Content
python f.write(data) tmp = f.name parts = [] subprocess.run(["pdftoppm", "-r", "150", "-l", "5", tmp, "/tmp/ocr_p"], capture_output=True, timeout=60) for img in sorted(Path("/tmp").glob("ocr_p*")): r = subprocess.run(["tesseract", str(img), "stdout", "-l", "eng+deu"],
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 80% confidence
- Finding
This repeatedly executes tesseract over images derived from untrusted PDFs. The risk is not command injection but unsafe processing of attacker-controlled content by external native tools, which can amplify denial-of-service risk across multiple pages/files.
- Content
python subprocess.run(["pdftoppm", "-r", "150", "-l", "5", tmp, "/tmp/ocr_p"], capture_output=True, timeout=60) for img in sorted(Path("/tmp").glob("ocr_p*")): r = subprocess.run(["tesseract", str(img), "stdout", "-l", "eng+deu"], capture_output=True, text=True, timeout=30) parts.append(r.stdout) img.unlink(missing_ok=True)
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 76% confidence
- Finding
This runs tesseract on attacker-controlled image content downloaded from Dropbox. Although it avoids shell injection, it still hands untrusted input to a native parser, which can be abused for denial of service or exploitation of vulnerabilities in the OCR toolchain.
- Content
python with tempfile.NamedTemporaryFile(delete=False, suffix=".jpg") as f: f.write(data) tmp = f.name r = subprocess.run(["tesseract", tmp, "stdout", "-l", "eng+deu"], capture_output=True, text=True, timeout=30) os.unlink(tmp) return r.stdout.strip()
Tainted flow: 'LOG_FILE' from os.environ.get (line 17, credential/environment) → open (file write)
Medium
- Category
- Data Flow
- Confidence
- 65% confidence
- Finding
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
- Content
python timestamp = datetime.now().strftime("%Y-%m-%d %H:%M:%S") line = f"[{timestamp}] {msg}\n" print(msg) with open(LOG_FILE, "a") as f: f.write(line) # ── Main ─────────────────────────────────────────────────────────────────────
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script downloads Dropbox documents and stores extracted contents as local markdown in a knowledge/memory workspace, creating a clear confidentiality risk. In an agent-skill context this is more dangerous because synced private files may become broadly accessible to other tools, prompts, indexes, or users of the local system without explicit consent or scoping.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 82% confidence
- Finding
The installer offers to create a persistent scheduled task that repeatedly runs the indexing script with access to the user's Dropbox-linked environment. Persistence is dangerous because if the indexed script or its dependencies are later modified, the cron job will continue executing them automatically, extending the blast radius and duration of compromise.
- Content
sh # Create cron job echo "⏰ Automated Sync Schedule" echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━" read -p "Create cron job for automatic syncing? [Y/n]: " create_cron if [[ ! "$create_cron" =~ ^[Nn]$ ]]; then echo " How often should indexing run?" echo " 1) Every 6 hours (recommended)"
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
sh # Check if Debian/Ubuntu if command -v apt-get &> /dev/null; then echo " Installing system packages via apt..." sudo apt-get update sudo apt-get install -y tesseract-ocr tesseract-ocr-eng tesseract-ocr-deu poppler-utils python3-pip elif command -v yum &> /dev/null; then echo " Installing system packages via yum..."
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
sh # Check if Debian/Ubuntu if command -v apt-get &> /dev/null; then echo " Installing system packages via apt..." sudo apt-get update sudo apt-get install -y tesseract-ocr tesseract-ocr-eng tesseract-ocr-deu poppler-utils python3-pip elif command -v yum &> /dev/null; then echo " Installing system packages via yum..."
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
sh # Check if Debian/Ubuntu if command -v apt-get &> /dev/null; then echo " Installing system packages via apt..." sudo apt-get update sudo apt-get install -y tesseract-ocr tesseract-ocr-eng tesseract-ocr-deu poppler-utils python3-pip elif command -v yum &> /dev/null; then echo " Installing system packages via yum..."
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
sh echo "🎉 Setup complete!" echo "" echo "Next steps:" echo " 1. Create Dropbox app at https://www.dropbox.com/developers/apps" echo " 2. Copy credentials to ~/.openclaw/.env (see .env.example)" echo " 3. Edit config.json to customize folders" echo " 4. Run: python3 dropbox-sync.py"
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The script reads DROPBOX_FULL_REFRESH_TOKEN, DROPBOX_FULL_APP_KEY, and DROPBOX_FULL_APP_SECRET from ~/.openclaw/.env and uses them to obtain an access token. While this is part of authentication, the file lacks any explicit disclosure in code comments or docstrings that it accesses stored credentials, which matches the missing-warning criterion for sensitive environment or credential access.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This shell installer writes a new user-config.json file and later overwrites dropbox-sync.py, which are file-modifying operations. Although the script prints status messages when saving and updating, it does not disclose in advance that it will modify these local files or that rerunning the installer will rewrite existing configuration/script content.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The closing instruction tells the user to ask the agent using the English phrase 'Search my Dropbox for...' and does not indicate that other languages are supported. This can be read as forcing an English-language interaction pattern without explicit user opt-in or justification.
- Content