MS Outlook + Teams Assistant

• Outcome: Review
• Latest audit: Jul 10, 2026 · 3:05 AM UTC
• Version: 1.0.1

Overview

This skill is purpose-aligned, but it needs careful review because it accesses private Outlook and Teams communications, stores local caches and tokens, and can surface message details through Telegram reminders.

Install only if you are comfortable giving the skill access to Outlook mailbox data and, if enabled, Teams chat data. Keep config, token cache, state, and thread JSON files out of shared or synced folders; review reminder content before sending it to Telegram; avoid broad subject searches on sensitive threads; and periodically delete cached scan and draft context files.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence
• Finding: The skill advertises and instructs use of file reads/writes, network access, and shell/package installation, but does not declare any permissions or trust boundaries. That mismatch is a real security issue because users and policy systems cannot accurately assess that the skill can access local Outlook data, persist state/config files, and transmit reminders or Teams data over the network.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script exports email subject, sender, recipients, and up to 8000 characters of the message body into a local JSON file, which can contain sensitive business or personal data. Because the output path is user-controllable and there is no warning, access control, or secure storage handling, this increases the risk of unintended disclosure through world-readable locations, synced folders, backups, or later reuse by other tools.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The script scans Outlook and optionally Teams, then writes the retrieved content into persistent cache files under state/. Those files can contain sensitive email and message metadata or content, and the code provides no access control, minimization, retention policy, or explicit user warning at the point of collection, which increases the risk of local disclosure on a shared or compromised machine.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script reads Outlook message bodies and metadata, then emits subjects, senders, recipients, and timestamps as JSON to stdout. In this skill context, that output is likely to be consumed by other automation, logs, terminals, or chat integrations, which can unintentionally disclose sensitive mailbox content and relationship metadata without explicit consent, minimization, or masking.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script serializes Teams message previews, sender identifiers, mention status, and the user's own reply previews directly to stdout as JSON. In agent/tooling environments, stdout is commonly captured by logs, parent processes, orchestration layers, or other skills, so this can expose sensitive workplace communications without any explicit consent gate, redaction, or output-scope control.

Context Leakage

High

• Category: Data Exfiltration

Content

- Either a message `EntryID` (preferred) or search by subject + recent window.

Behavior:
- Extract the thread (best-effort) + key metadata.
- Generate 2 drafts:
  - **Short** (2–5 sentences)
  - **Normal** (5–10 sentences)

• Confidence: 87% confidence
• Finding: Extract the thread

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.