office-outlook-mcp

• Outcome: Review
• Latest audit: Sep 21, 2026 · 11:36 AM UTC
• Version: 0.1.4

Overview

The skill is transparent about Outlook access, but it captures and stores a live mailbox token and exposes broad read/write helpers without tight safeguards.

Install only if you are comfortable letting the agent use a live Outlook session token for broad mailbox, calendar, contacts, tasks, and write access. Treat sending mail, moving messages, marking messages read, creating drafts, and calendar edits as actions that should require your explicit confirmation, and avoid using arbitrary curl arguments unless you understand exactly where the authorized request will go.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (11)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

outlook_get '/me' | jq .
```

- `outlook_get <path> [curl args]` — GET, body on stdout
- `outlook_get_text <path>` — same plus `Prefer: outlook.body-content-type="text"`; **use this for anything you will read** (measured 9.4× smaller than HTML)
- `outlook_post <path> <json>` / `outlook_patch <path> <json>`
- `outlook_token_expiry` — prints time remaining, never the token

• Confidence: 97% confidence
• Finding: This duplicate finding points to the same dangerous interface: authenticated requests can be modified with arbitrary curl arguments. In the context of a mailbox token captured from the browser, parameter abuse is especially severe because it can redirect requests or leak sensitive data and credentials outside the intended Outlook API boundary.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

outlook_get '/me' | jq .
```

- `outlook_get <path> [curl args]` — GET, body on stdout
- `outlook_get_text <path>` — same plus `Prefer: outlook.body-content-type="text"`; **use this for anything you will read** (measured 9.4x smaller than HTML)
- `outlook_post <path> <json>` / `outlook_patch <path> <json>`
- `outlook_token_expiry` — prints time remaining, never the token

• Confidence: 97% confidence
• Finding: This duplicate finding points to the same dangerous interface: authenticated requests can be modified with arbitrary curl arguments. In the context of a mailbox token captured from the browser, parameter abuse is especially severe because it can redirect requests or leak sensitive data and credentials outside the intended Outlook API boundary.

Chaining Abuse

High

• Category: Tool Misuse

Content

args=(-s -K "$rc_file" -X "$method" -H 'Accept: application/json'
        -o "$tmp" -w '%{http_code}' --max-time 60)
  http_status="$(curl "${args[@]}" "$@" "${OUTLOOK_API}${req_path}")" || {
    echo "curl failed" >&2; rm -f "$tmp"; return 1; }

  case "$http_status" in
    2*) cat "$tmp"; rm -f "$tmp"; return 0 ;;

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Chaining Abuse

High

• Category: Tool Misuse

Content

args=(-s -K "$rc_file" -X "$method" -H 'Accept: application/json'
        -o "$tmp" -w '%{http_code}' --max-time 60)
  http_status="$(curl "${args[@]}" "$@" "${OUTLOOK_API}${req_path}")" || {
    echo "curl failed" >&2; rm -f "$tmp"; return 1; }

  case "$http_status" in
    2*) cat "$tmp"; rm -f "$tmp"; return 0 ;;

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Chaining Abuse

High

• Category: Tool Misuse

Content

args=(-s -K "$rc_file" -X "$method" -H 'Accept: application/json'
        -o "$tmp" -w '%{http_code}' --max-time 60)
  http_status="$(curl "${args[@]}" "$@" "${OUTLOOK_API}${req_path}")" || {
    echo "curl failed" >&2; rm -f "$tmp"; return 1; }

  case "$http_status" in
    2*) cat "$tmp"; rm -f "$tmp"; return 0 ;;

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill exposes shell, environment, and file-reading behavior but does not declare any explicit tool scope or permissions boundaries. That omission increases the chance an agent will invoke powerful local capabilities without clear policy constraints, which is especially risky here because the skill also handles a live Outlook bearer token and mailbox data.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill advertises write-capable operations (`outlook_post` and `outlook_patch`) but does not clearly warn that using the skill can modify or send data in the user's mailbox, calendar, contacts, or tasks. In a mailbox context, silent write capability is dangerous because an agent could alter or create user data when the user expected only read access.

Session Persistence

Medium

• Category: Rogue Agent

Content

prints `run: outlook_token_refresh`.

Common starting points — full verified set, including calendar, contacts, tasks
and write payloads, in **`references/api-recipes.md`**:

```sh
outlook_get '/me/mailfolders/inbox?$select=UnreadItemCount,TotalItemCount'

• Confidence: 93% confidence
• Finding: The skill relies on a bearer token captured from the user's signed-in browser and notes a long lifetime (~25 hours), with storage in a local curl config for reuse. Persistent session material for a real mailbox materially increases the blast radius of compromise, since anyone or any process able to access that token can act as the user against Outlook during the token's validity window.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

local timeout="${1:-55}" tmp rc token dir
  dir="$OUTLOOK_FPX_DIR"
  mkdir -p "$dir" || return 1
  chmod 700 "$dir" 2>/dev/null

  command -v fpx >/dev/null 2>&1 || {
    echo "fpx not found — npm i -g @fetchproxy/cli" >&2; return 1; }

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

local rc_file; rc_file="$(_outlook_curlrc)"
  umask 077
  printf 'header = "Authorization: %s"\n' "$token" > "$rc_file" || return 1
  chmod 600 "$rc_file" 2>/dev/null
  echo "token stored in $rc_file ($(outlook_token_expiry))" >&2
}

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

External Transmission

Medium

• Category: Data Exfiltration

Content

args=(-s -K "$rc_file" -X "$method" -H 'Accept: application/json'
        -o "$tmp" -w '%{http_code}' --max-time 60)
  http_status="$(curl "${args[@]}" "$@" "${OUTLOOK_API}${req_path}")" || {
    echo "curl failed" >&2; rm -f "$tmp"; return 1; }

  case "$http_status" in
    2*) cat "$tmp"; rm -f "$tmp"; return 0 ;;

• Confidence: 96% confidence
• Finding: This helper uses a bearer token captured from the user's signed-in Outlook browser session and sends authenticated requests to the Outlook REST API via curl. That is an intentional external transmission of highly sensitive mailbox data and account-scoped credentials, which is security-relevant because compromise or misuse of the local environment or this skill can lead to unauthorized mailbox, calendar, contacts, and task access.

Static analysis

No suspicious patterns detected.