Security audit
Security checks across malware telemetry and agentic risk
This appears to be a real Dropbox read-only helper, but it grants broad Dropbox visibility and stores long-lived access credentials locally in ways users should review carefully.
Install only if you are comfortable giving this skill read access to Dropbox data. Prefer Dropbox App Folder access unless you truly need whole-account search, keep credentials.json and token.json out of git and backups, restrict their permissions, avoid running setup in recorded or shared terminals, revoke the Dropbox app if tokens may have leaked, and review every download path before allowing local writes.
const fs = require('fs').promises;
const path = require('path');
const CREDENTIALS_PATH = path.join(__dirname, 'credentials.json');
const TOKEN_PATH = path.join(__dirname, 'token.json');
// Buffer time: refresh 5 minutes before actual expirationconsole.log('\n✅ Success! Token saved to token.json');
console.log('\nToken details:');
console.log(` - Access token: ${tokenData.access_token.substring(0, 20)}...`);
if (tokenData.refresh_token) {
console.log(` - Refresh token: ${tokenData.refresh_token.substring(0, 20)}...`);
console.log(' - This token will not expire (use refresh token to get new access tokens)');"author": "",
"license": "MIT",
"dependencies": {
"dropbox": "^10.34.0"
}
}66/66 vendors flagged this skill as clean.
Detected: suspicious.exposed_secret_literal, suspicious.potential_exfiltration