ClawHub
Back to skill

Security audit

Dropbox Manager

Security checks across malware telemetry and agentic risk

Overview

The skill mostly matches Dropbox file management, but one bundled setup guide tells users to run an unpinned npm MCP server with Dropbox credentials.

Install only if you are comfortable granting Dropbox read/write access and local file transfer authority. Prefer the documented Swift Dropbook build path, avoid the `npx -y dbx-mcp-server` setup unless you independently trust and pin that package, and require confirmation before uploads, downloads, deletes, overwrites, or rclone sync operations.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The file inconsistently refers to a `dropbox-skill` while claiming it integrates with `Dropbook`, which creates ambiguity about the actual target service. In an agent skill, this can misdirect operators, cause the wrong executable or credentials to be wired up, and potentially route data or actions to an unintended system.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The manifest explicitly requires Dropbox credentials and exposes upload/download capabilities, but it does not warn users that local file contents may be transmitted to a third-party cloud service or that sensitive tokens must be handled securely. In a file-management skill, that omission increases the risk of accidental secret exposure or unintended data exfiltration through normal use.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill documents `rclone sync` as a common operation and notes it will delete files not in the source, but it does not provide a strong, explicit safety warning immediately adjacent to the command. In an agent skill context, destructive examples can be copied or automated, increasing the risk of accidental data loss if users or agents run the command against the wrong path.

Credential Access

High
Category
Privilege Escalation
Content
3. Prompt you to paste the authorization code
4. Exchange code for access and refresh tokens
5. **Save tokens to macOS Keychain** (hardware-backed encryption)
6. Fall back to `~/.dropbook/auth.json` if Keychain unavailable
7. Enable automatic token refreshing

**Security Features (RFC 9700 compliant):**
Confidence
89% confidence
Finding
Keychain

Session Persistence

Medium
Category
Rogue Agent
Content
rclone authorize dropbox

# Save the token output to config
mkdir -p ~/.config/rclone
cat > ~/.config/rclone/rclone.conf << 'EOF'
[dropbox]
type = dropbox
Confidence
90% confidence
Finding
mkdir -p ~/.config/rclone cat > ~/.config

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.