grab-my-files

Pass

Audited by Gen Agent Trust Hub on Aug 30, 2026

Risk Level: SAFE
Full Analysis
  • [File System Operations]: The skill interacts with the /app/created/ directory, which is the standard sandbox location for Copilot Studio generated files. It recursively lists and packages these files into a timestamped ZIP archive. This is a routine operation for a file-management utility and follows the principle of least privilege by staying within the expected application path.
  • [Cleanup Logic]: The skill includes instructions to delete previous export archives (all_files_produced_*.zip) after a new one is successfully created. This is a maintenance function to manage storage space within the ephemeral session environment and does not involve deleting user data outside the skill's specific output scope.
  • [Data Filtering]: Instructions are provided to exclude system files (e.g., .DS_Store, Thumbs.db) and previous archives from the new ZIP. This prevents recursion (zipping a zip within a zip) and ensures the download contains only relevant session artifacts.
  • [Platform-Specific Delivery]: The skill leverages native platform behavior (writing to /app/created/ to trigger a download attachment). This utilizes built-in security and delivery mechanisms rather than attempting to exfiltrate data to external endpoints.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 30, 2026, 11:55 PM
Security Audit — agent-trust-hub — grab-my-files