clipboard-sync-cross-device

Pass

Audited by Gen Agent Trust Hub on Oct 8, 2026

Risk Level: SAFEDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [DATA_EXFILTRATION]: The skill is designed to monitor the system clipboard and upload its content to cloud storage services (Google Drive and Dropbox). While this is the primary functionality, the clipboard often contains sensitive information such as passwords or personal data. The skill mitigates this risk by implementing AES-GCM encryption using user-provided passwords.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data directly from the system clipboard.
  • Ingestion points: System clipboard accessed via pyperclip.paste() in the ClipboardMonitor class within SKILL.md.
  • Boundary markers: No specific delimiters or safety instructions are used when interpolating clipboard content into the synchronization pipeline.
  • Capability inventory: File system access for writing to clipboard_history.db (SQLite) and token.json, and network access via the Google Drive and Dropbox APIs.
  • Sanitization: The skill does not perform sanitization or validation on the clipboard content before it is stored or uploaded to the cloud.
  • [EXTERNAL_DOWNLOADS]: The instructions recommend cloning a source code repository from GitHub (github.com/mariusboiti/Clipboard_Sync.git) and installing multiple third-party Python dependencies from the public PyPI registry.
  • [COMMAND_EXECUTION]: The documentation includes shell commands for package installation and environment variable configuration.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 8, 2026, 11:44 PM