dropbox

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). Several URLs are personal/shared-file links and opaque short/placeholder hosts (Dropbox shared links and bare/shortened domains like "https://x") which are common vectors for distributing arbitrary files or hiding malicious executables, so they are suspicious for download/execute scenarios.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In the Dropbox agent-skill runtime, the tool getFileContents directly ingests outsider-controlled free text via ctx.fetch(https://content.dropboxapi.com/2/files/download) and decodes the response bytes into content (UTF-8) returned to the agent.