Clawdbot Skill Dropbox

• Outcome: Pass
• Latest audit: Jul 10, 2026 · 3:58 AM UTC
• Version: 1.0.1

Overview

This is a coherent Dropbox command-line skill, but it needs careful handling because it stores Dropbox tokens locally and can write downloaded files to chosen paths.

Install only if you want an agent to manage Dropbox files. Prefer an App Folder-scoped Dropbox app when possible, keep ~/.config/atlas/dropbox.env private with restrictive permissions such as chmod 600, never commit or share that file, review upload/download paths before running commands, and revoke the Dropbox app if the token file may have been exposed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill documents capabilities that perform network access and local file writes, but it does not declare permissions or provide an explicit trust boundary for those actions. This is dangerous because users may invoke the skill without understanding that it can contact Dropbox and rewrite local credential material on disk.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README instructs users to store the Dropbox app secret, access token, and refresh token in a local plaintext env file without any warning about file permissions, secret handling, or alternative secure storage. In a headless/server context this increases the chance that long-lived credentials are exposed through weak filesystem permissions, backups, shell history, or accidental commits.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill states that it automatically updates `dropbox.env` with a new access token, but it does not warn the user that secrets will be rewritten on disk. Silent modification of a credential file can lead to accidental exposure, corruption of secrets, or unsafe file permissions if the write operation is not carefully controlled.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The download path is written directly to the local filesystem with no safeguards against overwriting an existing file when --output is supplied. In an agent context, this can unexpectedly clobber local files or place remote content into sensitive locations if a caller provides a dangerous path.

Credential Access

High

• Category: Privilege Escalation

Content

The script automatically handles token refresh:

1. On 401 Unauthorized, it uses the refresh token to get a new access token
2. Updates `dropbox.env` with the new access token
3. Retries the original request

## Token Lifecycle

• Confidence: 90% confidence
• Finding: Automatically updating `dropbox.env` with a fresh access token means the skill is handling live credentials and persisting them to a local file. If that file is readable by other users, checked into source control, backed up insecurely, or overwritten unsafely, an attacker could obtain reusable Dropbox access and compromise account data.

Credential Access

High

• Category: Privilege Escalation

Content

import argparse
from pathlib import Path

CONFIG_PATH = Path.home() / ".config/atlas/dropbox.env"

# Global config cache
_config = None

• Confidence: 91% confidence
• Finding: The script stores Dropbox credentials in a predictable plaintext file under the user's home directory. If file permissions are too broad, local attackers or other processes could read refresh tokens and app secrets, enabling persistent access to the Dropbox account.

Credential Access

High

• Category: Privilege Escalation

Content

def load_config():
    """Load all credentials from the .env file."""
    global _config
    if _config is not None:
        return _config

• Confidence: 90% confidence
• Finding: The configuration loader reads credentials directly from a plaintext .env file without any permission checks or protection measures. In multi-user or poorly secured environments, this increases the risk of token theft and subsequent unauthorized Dropbox access.

Credential Access

High

• Category: Privilege Escalation

Content

def save_config(config):
    """Save config back to .env file."""
    global _config
    lines = []
    for key, value in config.items():

• Confidence: 95% confidence
• Finding: The script writes sensitive credentials back to disk in plaintext and does not set restrictive permissions when saving. Depending on the process umask and existing file state, refreshed access tokens and app secrets may become readable by unintended local users or software.

Credential Access

High

• Category: Privilege Escalation

Content

if not new_access_token:
                raise ValueError("No access_token in refresh response")
            
            # Update config with new access token
            config["DROPBOX_ACCESS_TOKEN"] = new_access_token
            save_config(config)

• Confidence: 94% confidence
• Finding: After refreshing, the new access token is persisted to the same plaintext config file, extending the credential exposure window on disk. An attacker who can read that file gains immediate authenticated access to Dropbox APIs until the token expires, and may also obtain the refresh token for persistence.

Session Persistence

Medium

• Category: Rogue Agent

Content

## Setup

### 1. Create Dropbox App

1. Go to https://www.dropbox.com/developers/apps
2. Create app → Scoped access → Full Dropbox

• Confidence: 73% confidence
• Finding: The README recommends creating a Dropbox app with 'Full Dropbox' access, which grants broad persistent access beyond least privilege for many use cases. Combined with locally stored long-lived refresh tokens, compromise of the host or config file could expose the user's entire Dropbox rather than an app-scoped subset.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.