Dropbox Integration

This skill appears to implement a legitimate read-only Dropbox integration, but check a few things before installing: - Trust & provenance: the owner/homepage is unknown. Only install if you trust the source or have reviewed the code yourself. - Metadata mismatch: the registry metadata claims no required config paths/env vars, but the code requires credentials.json (app_key/app_secret) and produces token.json — ensure you provide these files and protect them. - Least privilege: consider creating an 'App folder' Dropbox app instead of 'Full Dropbox' to limit exposure, unless you need account-wide reads. - Protect secrets: credentials.json and token.json are stored on disk in the skill directory; ensure .gitignore is correct and set restrictive file permissions (e.g., 0600). Rotate/revoke tokens if the machine or skill environment is compromised. - Node & environment: run the skill in a controlled environment (container or dedicated user) and run 'npm install' inside that environment. Verify Node version (uses fetch and modern SDK—Node 18+ recommended). - Use caution when downloading: the download script writes to any local path you supply — avoid passing sensitive system paths to the skill or letting the agent choose target paths without constraints. If you want higher assurance, have someone you trust review the included JS files (setup-oauth.js, dropbox-helper.js, etc.) and confirm token storage and refresh behavior are acceptable.