clipboard-sync-cross-device
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [DATA_EXFILTRATION]: The skill is designed to monitor the system clipboard and upload its content to cloud storage services (Google Drive and Dropbox). While this is the primary functionality, the clipboard often contains sensitive information such as passwords or personal data. The skill mitigates this risk by implementing AES-GCM encryption using user-provided passwords.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data directly from the system clipboard.
- Ingestion points: System clipboard accessed via
pyperclip.paste()in theClipboardMonitorclass withinSKILL.md. - Boundary markers: No specific delimiters or safety instructions are used when interpolating clipboard content into the synchronization pipeline.
- Capability inventory: File system access for writing to
clipboard_history.db(SQLite) andtoken.json, and network access via the Google Drive and Dropbox APIs. - Sanitization: The skill does not perform sanitization or validation on the clipboard content before it is stored or uploaded to the cloud.
- [EXTERNAL_DOWNLOADS]: The instructions recommend cloning a source code repository from GitHub (
github.com/mariusboiti/Clipboard_Sync.git) and installing multiple third-party Python dependencies from the public PyPI registry. - [COMMAND_EXECUTION]: The documentation includes shell commands for package installation and environment variable configuration.
Audit Metadata