clipboard-sync-cross-device

Pass

Audited by Gen Agent Trust Hub on Jul 1, 2026

Risk Level: SAFEDATA_EXFILTRATIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [DATA_EXFILTRATION]: The skill is designed to monitor and transmit local clipboard content to external cloud storage providers (Google Drive or Dropbox). While this is the primary intended function, users should be aware that all data copied to the clipboard, including passwords or sensitive personal information if not carefully managed, will be uploaded to the cloud.
  • [EXTERNAL_DOWNLOADS]: The installation instructions direct users to clone a code repository from an external GitHub account (mariusboiti/Clipboard_Sync) that is not explicitly linked to the skill author's domain. Users should review the source code of the repository before execution.
  • [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface as it ingests untrusted data from both the local system clipboard and remote cloud storage.
  • Ingestion points: Content is pulled from the system clipboard via pyperclip.paste() and from the cloud via download_clipboard().
  • Boundary markers: None identified in the provided implementation; content is handled as raw strings.
  • Capability inventory: The skill has the capability to write to a local SQLite database (clipboard_history.db), write to local files (token.json), and perform network operations to Google/Dropbox APIs.
  • Sanitization: The code performs encryption/decryption but does not sanitize the content of the clipboard data before processing or storing it.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 1, 2026, 09:05 PM
Security Audit — agent-trust-hub — clipboard-sync-cross-device