xdrop
Pass
Audited by Gen Agent Trust Hub on Apr 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes local scripts (
upload.mjsanddownload.mjs) executed via the Bun runtime to manage file operations and network requests. - [DATA_EXFILTRATION]: Performs file uploads to user-defined Xdrop servers. While this involves sending local data to a remote endpoint, it is the primary intended function of the skill and requires user-provided configuration (server URL).
- [EXTERNAL_DOWNLOADS]: Fetches encrypted data and manifests from remote servers during the download and decryption process.
- [SAFE]: Includes a robust
sanitizePathfunction inscripts/download.mjsthat prevents directory traversal attacks by filtering out '..' segments and stripping dangerous characters from server-provided filenames. - [SAFE]: Employs standard cryptographic practices using
node:cryptoandcrypto.subtlefor AES-GCM encryption and HKDF key derivation, ensuring file content remains encrypted while stored on the intermediary server.
Audit Metadata