Pilot Dropbox

Shared folder that automatically synchronizes between peers using Pilot Protocol pub/sub. Use this skill when: 1. You need a persistent shared folder that st...

This skill appears to implement the shared-folder behavior it claims, but you should: 1) verify pilotctl and the pilot-protocol implementation come from a trusted source; 2) ensure the system has jq, md5sum (coreutils), and a file watcher (fswatch or inotifywait) installed — the registry metadata does not declare these dependencies; 3) only join peers/topics you trust because the skill will transmit local files to remote peers via pilotctl; 4) test the workflow in an isolated or non-sensitive directory before pointing it at important data; 5) consider running the watcher under a dedicated user or container to limit blast radius; and 6) if you expect stricter consistency or access controls, prefer other listed alternatives in the SKILL.md (pilot-sync / pilot-stream-data) or inspect pilotctl's auth model first.

Type: OpenClaw Skill Name: pilot-dropbox Version: 1.0.0 The skill implements a shared folder synchronization system but contains significant path traversal vulnerabilities in the bash logic within SKILL.md. Specifically, the 'file_removed' and 'dropbox_pull' event handlers use the $FILENAME variable directly from remote JSON input without sanitization, which could allow a malicious peer to delete or exfiltrate arbitrary files outside the intended directory. While these appear to be unintentional vulnerabilities rather than intentional malware, they represent a high security risk.