Security audit
Security checks for vulnerabilities and agentic risk
ClawScan marked this skill suspicious because its read-focused purpose is paired with shell helpers that can make state-changing Teams requests and send an authorization header to other destinations if their arguments are controlled.
Consider avoiding installation until the helper's request options are restricted to approved read operations, the write instructions are removed or clearly separated behind approval, and the missing tool scope is clarified. The scan is partial: although all three listed components were scanned, several local references could not be resolved, so the evidence is incomplete.
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
args=(-s -K "$rc_file" -H 'behavioroverride: redirectAs404'
-o "$tmp" -w '%{http_code}' --max-time 60)
http_status="$(curl "${args[@]}" "$@" "$url")" || {
echo "curl failed" >&2; rm -f "$tmp"; return 1; }
case "$http_status" in
2*) cat "$tmp"; rm -f "$tmp"; return 0 ;;
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
echo "curl failed" >&2; rm -f "$tmp"; return 1; }
case "$http_status" in
2*) cat "$tmp"; rm -f "$tmp"; return 0 ;;
401) echo "401 — token expired or revoked. Run: teams_token_refresh" >&2
rm -f "$tmp"; return 4 ;;
*) echo "HTTP $http_status" >&2; sed -n '1,5p' "$tmp" >&2; rm -f "$tmp"; return 4 ;;
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
2*) cat "$tmp"; rm -f "$tmp"; return 0 ;;
401) echo "401 — token expired or revoked. Run: teams_token_refresh" >&2
rm -f "$tmp"; return 4 ;;
*) echo "HTTP $http_status" >&2; sed -n '1,5p' "$tmp" >&2; rm -f "$tmp"; return 4 ;;
esac
}
Without declared permissions the skill's intent is opaque and cannot be validated.
The manifest describes reading Teams data, but this section supplies POST and PUT endpoints for sending messages and adding reactions using the captured bearer token. Requiring approval for each post reduces risk but does not reconcile these remote-write instructions with the manifest's read-focused scope.
The purportedly read-only helpers forward arbitrary arguments to authenticated curl, allowing callers to supply methods and bodies such as -X POST and --data to perform state-changing Teams requests. Additional URL arguments can also send the configured Authorization header to an unapproved destination, so the primary-URL allowlist does not fully protect the bearer token; exploitation requires control over arguments passed to the helper.