Outlook Delegate

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:17 PM UTC
• Version: 1.0.0

Overview

This Outlook delegate skill is openly about managing another mailbox, but it asks for broad mail/calendar authority and documents token handling in ways users should review carefully before installing.

Review this before installing. Only use it with a dedicated assistant account, least-privilege Exchange delegation, and explicit owner consent. Avoid FullAccess unless truly required, do not print or share raw tokens, protect `~/.outlook-mcp/` with owner-only permissions or a secret store, and verify any missing scripts from a trusted source before running them.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:29

Finding

OAuth tokens and client secrets stored in plaintext without enforced access controls

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 29–38 and 196–203
Vulnerability Type: Plaintext sensitive credential storage
Risk Level: Medium

Vulnerable Code Snippets

markdown

### Config File: `~/.outlook-mcp/config.json`

```json
{
  "client_id": "your-app-client-id",
  "client_secret": "your-app-client-secret",
  "owner_email": "[e-mail]",
  "delegate_email": "[e-mail]"
}

text

```markdown
## Security Considerations

1. **Audit Trail**: All actions by the assistant are logged in the owner's mailbox audit log
2. **Token Storage**: Credentials stored in `~/.outlook-mcp/` - protect this directory
3. **Scope Limitation**: The assistant only has access to what the owner explicitly grants
4. **Revocation**: The owner can revoke access anytime via Delegate settings

## Files

- `~/.outlook-mcp/config.json` - Client ID, secret, and owner/delegate emails
- `~/.outlook-mcp/credentials.json` - OAuth tokens (access + refresh)

Technical Analysis

The Skill instructs users to store an OAuth client secret, access token, and long-lived refresh token in ordinary files under ~/.outlook-mcp/. Local credential storage is necessary for the declared Microsoft Graph integration, but the documentation neither creates the directory and files with restrictive permissions nor requires permission validation before use. It also does not recommend an operating-system credential manager or encrypted secret store.

Merely advising users to “protect this directory” does not enforce confidentiality. Depending on the user's umask, file creation method, backup configuration, or synchronization tools, the files could be readable by other local users or processes. Refresh tokens are particularly sensitive because they may be exchanged for new access tokens and can provide continuing access until revoked or invalidated.

The documented outlook-token.sh get operation also ...[truncated 1940 chars]

Remediation

View remediation

Remediation Suggestions

1. Create the credential directory with owner-only permissions:

   bash

   install -d -m 0700 "$HOME/.outlook-mcp"
   

2. Create credential-bearing files with mode 0600, and set a restrictive umask before writing them:

   bash

   umask 077
   install -m 0600 /dev/null "$HOME/.outlook-mcp/config.json"
   install -m 0600 /dev/null "$HOME/.outlook-mcp/credentials.json"
   

3. Validate ownership and permissions before loading credentials. Refuse operation if the directory is not owned by the current user or if group/other permissions are present.

4. Prefer an operating-system keychain, encrypted secret manager, or managed identity mechanism over plaintext JSON files. Store only non-secret identifiers such as email addresses in the configuration file.

5. Avoid printing access tokens to standard output. If a token retrieval operation is indispensable, require explicit confirmation, avoid logging, and clearly warn users that the output is sensitive.

6. Exclude the credential directory from source control, cloud synchronization, diagnostics, and unencrypted backups.

7. Request only permissions required by the intended deployment. Avoid Exchange FullAccess when Reviewer, Editor, or folder-specific delegation is sufficient.

8. Document concrete token-revocation and incident-response procedures, including revoking refresh tokens, rotating client secrets, removing Exchange delegation, and reviewing Microsoft 365 audit logs after suspected exposure.

9. Add automated checks or tests confirming that credential files are never written with permissions broader than 0600.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

The skill explicitly provides a command to print the access token (outlook-token.sh get). In an agent setting, exposing bearer tokens to stdout/chat logs creates a real credential leakage path: any user, plugin, transcript store, or downstream tool that can read output may reuse the token to access the delegated owner's mail and calendar with the granted Microsoft Graph scopes.

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

bash

./scripts/outlook-token.sh refresh   # Refresh expired token
./scripts/outlook-token.sh test      # Test connection to BOTH accounts
./scripts/outlook-token.sh get       # Print access token

Reading Owner's Emails

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 203)May include surrounding context.

md

## Files

- `~/.outlook-mcp/config.json` - Client ID, secret, and owner/delegate emails
- `~/.outlook-mcp/credentials.json` - OAuth tokens (access + refresh)

## Changelog

Static analysis

No suspicious patterns detected.