dropbox
Enables management of Dropbox files through a Swift-native CLI, utilizing OAuth 2.0 for secure authentication and file operations.
Install this skill
Security score
The dropbox skill was audited on Feb 27, 2026 and we found 22 security issues across 4 threat categories, including 10 high-severity. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 227 | ```json |
Template literal with variable interpolation in command context
| 251 | ```json |
Access to hidden dotfiles in home directory
| 39 | 6. Fall back to `~/.dropbook/auth.json` if Keychain unavailable |
Access to hidden dotfiles in home directory
| 311 | mkdir -p ~/.config/rclone |
Access to hidden dotfiles in home directory
| 312 | cat > ~/.config/rclone/rclone.conf << 'EOF' |
Access to system keychain/keyring
| 7 | Manage Dropbox files via MCP server and CLI. Swift-native implementation using SwiftyDropbox SDK with OAuth 2.0 PKCE and secure Keychain token storage. |
Access to system keychain/keyring
| 22 | #### Option 1: OAuth Login with Keychain (Recommended) |
Access to system keychain/keyring
| 24 | Use the interactive OAuth flow with secure Keychain storage: |
Access to system keychain/keyring
| 38 | 5. **Save tokens to macOS Keychain** (hardware-backed encryption) |
Access to system keychain/keyring
| 39 | 6. Fall back to `~/.dropbook/auth.json` if Keychain unavailable |
Access to system keychain/keyring
| 45 | - Keychain storage with `kSecAttrAccessibleWhenUnlocked` |
Access to system keychain/keyring
| 60 | Clear stored tokens from both Keychain and file storage: |
Access to system keychain/keyring
| 201 | make login # OAuth login with Keychain storage |
Access to system keychain/keyring
| 273 | | `itemNotFound` | No token in Keychain | Run `make login` to authenticate | |
Access to system keychain/keyring
| 281 | │ │ ├── Auth/ # Keychain & file token storage |
Access to system keychain/keyring
| 385 | 1. **Use OAuth login** - Secure Keychain storage with automatic token refresh |
Access to system keychain/keyring
| 395 | - **Keychain Storage**: Tokens stored with hardware-backed encryption |
External URL reference
| 296 | For large-scale operations like backups, syncing, or bulk transfers, use [rclone](https://rclone.org/) - a powerful cloud sync tool with native Dropbox support. |
External URL reference
| 412 | - [Dropbox API Docs](https://www.dropbox.com/developers/documentation) |
External URL reference
| 413 | - [rclone Dropbox Docs](https://rclone.org/dropbox/) - Bulk sync and backup |
External URL reference
| 414 | - [RFC 7636 - PKCE](https://datatracker.ietf.org/doc/html/rfc7636) |
External URL reference
| 415 | - [RFC 9700 - OAuth 2.0 Security Best Practices](https://datatracker.ietf.org/doc/html/rfc9700) |