Dropbox Manager

• Analyzed: May 12, 2026, 3:02 AM
• Findings: 1
• Version: 1.0.0
• Hash: 88d62bf891850ddf8f946850e3bb5a5fa57e6b0f6cfd7373f728c2b6ae3e5d09
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill provides legitimate Dropbox management capabilities, including tools to upload local files and download files to local paths, which grant broad file system access to the agent. The most significant concern is an instruction in `references/mcp-setup.md` that suggests using `npx -y dbx-mcp-server` to set up the MCP server. This command downloads and executes an arbitrary Node.js package from npm without user confirmation, posing a supply chain risk. While this instruction contradicts the primary `SKILL.md` and `SKILL.json` which specify a locally built Swift executable, its presence in the skill bundle's documentation makes it a suspicious element due to the potential for arbitrary code execution from an external source.