Skill

dropbox

skill:yc-software/qm#dropbox

Browse, search, read, upload, and share the user's Dropbox — including team/shared folders — through per-user OAuth.

SkillsMP

Verdict

Inconclusive

The analysis could not cover enough of the artifact to decide.

Analyzed Oct 27, 2026, 22:27 UTC at 9432ce5

findings

—

highest severity

threat classes

2,607

files scanned

23/23

checks satisfied

package advisories

Why this verdict

inconclusive: gap skill_frontmatter_invalid at .claude/skills/dev-instance/SKILL.md
inconclusive: gap skill_frontmatter_invalid at .claude/skills/update-qm/SKILL.md
inconclusive: gap skill_frontmatter_invalid at .claude/skills/upstream-pr/SKILL.md
inconclusive: unresolved question on CRED

Security findings 0

No individual findings recorded

The inconclusive verdict rests on the open questions and coverage gaps below; 2 candidate findings were refuted on review.

Open questions 4

What the analysis could not settle from the code alone.

The skill asserts the runtime injects per-user Dropbox OAuth tokens as VAULT_TOKEN_API_DROPBOXAPI_COM and VAULT_TOKEN_CONTENT_DROPBOXAPI_COM environment variables (and that one works as bearer for any Dropbox host); this injection and host-reuse behavior cannot be verified from the skill text alone.

Credential access

The declared description covers browse/search/read/upload/share, but the skill also instructs move (files/move_v2) and delete (files/delete_v2) operations on the user's Dropbox; are these undeclared write/destructive capabilities within the intended scope?

Destructive action

Residue R1/R2 adjudicated as necessary (env token read for the wrapped service is the declared per-user OAuth mechanism), but the artifact's claim that VAULT_TOKEN_API_DROPBOXAPI_COM and VAULT_TOKEN_CONTENT_DROPBOXAPI_COM are host-injected per-user Dropbox connector tokens restates platform behavior that cannot be verified from the artifact shown; whether the bearer value sent to Dropbox is always the current user's own token is unsettled.

Credential access

[file request mcp-server] Where does the runtime inject the VAULT_TOKEN_API_DROPBOXAPI_COM and VAULT_TOKEN_CONTENT_DROPBOXAPI_COM environment variables, and are their values ever sent to any host other than api.dropboxapi.com/content.dropboxapi.com, logged, or written to disk?

Credential access

Refuted findings 2

Candidates the review stage examined and rejected, kept for transparency.

Credential access

criticalRefutedlow confidence

The skill instructs the agent to read the user's Dropbox OAuth bearer token from environment variables and attach it as an Authorization header on every Dropbox API call; the destination hosts are declared (api/content.dropboxapi.com) and match the wrapped service, so this is disclosed wrapped-service credential use rather than established exfiltration.

skills-seed/dropbox/SKILL.md:23

Pass it as `-H

Why it was refuted

Reading the resolved user's own Dropbox token from env and attaching it as a bearer header to api/content.dropboxapi.com is exactly the env-API-key-for-the-wrapped-service carve-out and the declared per-user-OAuth core capability: the hosts are declared as required egress and the env vars are openly declared (D2-D5). The flagged D6 'contradiction' is spurious — using the user's own resolved token is not asking for it, logging it, using another principal's credential, or a service fallback.

Agent hijacking

criticalRefutedlow confidence

The skill instructs the agent to conceal the actual remedy from channel users ('don't tell a channel user to reconnect') and instead steer them into a DM, leaving the user uninformed about why Dropbox commands fail in channels.

skills-seed/dropbox/SKILL.md:29

So don't tell a channel user to

Why it was refuted

The text does not mean what the claim says: it conceals no remedy and hides no action from the user. Reconnecting is documented as ineffective in channels ('absent by design, even for a fully-connected user'), and the agent openly directs the user to the actual working remedy (DM, where the declared per-user token is injected); the mechanism is stated in the same sentence and DM-only reconnect advice is still given where it applies (lines 30, 38), so the RX-HIJACK-SECRECY reading of benign operational guidance misreads the text.

Coverage gaps 18

Parts of the artifact the static analysis could not fully examine.

context:unanalyzable_binary binary content is only byte-scanned

desktop/assets/qm.icns

context:unanalyzable_binary pdf content is only byte-scanned

test/fixtures/documents/encrypted.pdf

context:unanalyzable_binary pdf content is only byte-scanned

test/fixtures/documents/hostile.pdf

context:unanalyzable_binary binary content is only byte-scanned

test/fixtures/documents/sample.doc

context:unanalyzable_binary pdf content is only byte-scanned

test/fixtures/documents/sample.pdf

context:unanalyzable_binary binary content is only byte-scanned

test/fixtures/documents/sample.ppt

context:unanalyzable_binary binary content is only byte-scanned

test/fixtures/documents/sample.pptx!/ppt/printerSettings/printerSettings1.bin

context:unanalyzable_binary binary content is only byte-scanned

test/fixtures/documents/sample.xls

context:unanalyzable_binary pdf content is only byte-scanned

test/fixtures/documents/scanned.pdf

skill_frontmatter_invalid missing name/description frontmatter

.claude/skills/dev-instance/SKILL.md

skill_frontmatter_invalid missing name/description frontmatter

.claude/skills/update-qm/SKILL.md

skill_frontmatter_invalid missing name/description frontmatter

.claude/skills/upstream-pr/SKILL.md