Security audit
Security checks across malware telemetry and agentic risk
This is a coherent Dropbox command-line skill, but it needs careful handling because it stores Dropbox tokens locally and can write downloaded files to chosen paths.
Install only if you want an agent to manage Dropbox files. Prefer an App Folder-scoped Dropbox app when possible, keep ~/.config/atlas/dropbox.env private with restrictive permissions such as chmod 600, never commit or share that file, review upload/download paths before running commands, and revoke the Dropbox app if the token file may have been exposed.
The script automatically handles token refresh: 1. On 401 Unauthorized, it uses the refresh token to get a new access token 2. Updates `dropbox.env` with the new access token 3. Retries the original request ## Token Lifecycle
import argparse from pathlib import Path CONFIG_PATH = Path.home() / ".config/atlas/dropbox.env" # Global config cache _config = None
def load_config():
"""Load all credentials from the .env file."""
global _config
if _config is not None:
return _configdef save_config(config):
"""Save config back to .env file."""
global _config
lines = []
for key, value in config.items():if not new_access_token:
raise ValueError("No access_token in refresh response")
# Update config with new access token
config["DROPBOX_ACCESS_TOKEN"] = new_access_token
save_config(config)## Setup ### 1. Create Dropbox App 1. Go to https://www.dropbox.com/developers/apps 2. Create app → Scoped access → Full Dropbox
65/65 vendors flagged this skill as clean.
No suspicious patterns detected.