dropbox-automation

SUSPICIOUS. The skill’s Dropbox capabilities are largely aligned with its stated purpose and use an official same-org Rube/Composio endpoint, so it is not a clear malware or installer-based supply-chain lure. However, it routes Dropbox access and OAuth through a third-party managed gateway, and the documentation minimizes that trust boundary by claiming no API keys/auth setup are needed. Main risk is third-party credential/data mediation and mildly misleading setup claims, not overt malicious behavior.