ClawHub
Back to skill

Security audit

office-outlook-mcp

Security checks for vulnerabilities and agentic risk

Overview

ClawScan marks this skill suspicious because scanners report a risk that arbitrary curl options could expose mailbox credentials or data to an unintended destination.

Consider the suspicious verdict and the risk of credential exposure before installing. The review is based on partial analysis: three components were scanned, but two local references were unresolved, so the evidence is incomplete. The scanners did not establish that credentials were actually exposed.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
92% confidence
Finding

The documented interface permits arbitrary curl arguments for requests carrying a mailbox bearer token. Additional URLs or destination-changing options can cause credential disclosure, while other options can enable local file uploads or unintended writes; the token's mailbox access makes this substantially more sensitive than a generic HTTP helper.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

outlook_get '/me' | jq .

text

- `outlook_get <path> [curl args]` — GET, body on stdout
- `outlook_get_text <path>` — same plus `Prefer: outlook.body-content-type="text"`; **use this for anything you will read** (measured 9.4× smaller than HTML)
- `outlook_post <path> <json>` / `outlook_patch <path> <json>`
- `outlook_token_expiry` — prints time remaining, never the token

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
92% confidence
Finding

This finding identifies the same unrestricted curl-argument interface as the other TM1 finding. Passing arbitrary options to a token-bearing HTTP client can introduce additional destinations or file-transfer behavior, potentially exposing the user's mailbox credentials or local data.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

outlook_get '/me' | jq .

text

- `outlook_get <path> [curl args]` — GET, body on stdout
- `outlook_get_text <path>` — same plus `Prefer: outlook.body-content-type="text"`; **use this for anything you will read** (measured 9.4x smaller than HTML)
- `outlook_post <path> <json>` / `outlook_patch <path> <json>`
- `outlook_token_expiry` — prints time remaining, never the token

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · references/outlook-env.sh (reported line 133)May include surrounding context.

sh
args=(-s -K "$rc_file" -X "$method" -H 'Accept: application/json'
        -o "$tmp" -w '%{http_code}' --max-time 60)
  http_status="$(curl "${args[@]}" "$@" "${OUTLOOK_API}${req_path}")" || {
    echo "curl failed" >&2; rm -f "$tmp"; return 1; }

  case "$http_status" in
    2*) cat "$tmp"; rm -f "$tmp"; return 0 ;;

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · references/outlook-env.sh (reported line 136)May include surrounding context.

sh
echo "curl failed" >&2; rm -f "$tmp"; return 1; }

  case "$http_status" in
    2*) cat "$tmp"; rm -f "$tmp"; return 0 ;;
    401) echo "401 — token expired or revoked. Run: outlook_token_refresh" >&2
         rm -f "$tmp"; return 4 ;;
    *)  echo "HTTP $http_status" >&2; sed -n '1,5p' "$tmp" >&2; rm -f "$tmp"; return 4 ;;

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · references/outlook-env.sh (reported line 139)May include surrounding context.

sh
2*) cat "$tmp"; rm -f "$tmp"; return 0 ;;
    401) echo "401 — token expired or revoked. Run: outlook_token_refresh" >&2
         rm -f "$tmp"; return 4 ;;
    *)  echo "HTTP $http_status" >&2; sed -n '1,5p' "$tmp" >&2; rm -f "$tmp"; return 4 ;;
  esac
}

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, shell.

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
97% confidence
Finding

Sending authenticated requests to Outlook is intended, but the request helper forwards arbitrary arguments to curl and accepts an environment-overridable API base without destination validation. An attacker who influences those inputs can add an external URL or replace the destination, causing the Authorization header loaded from the config file to be sent outside Outlook; shell quoting does not prevent this curl-level abuse.

Content

Scanner excerpt · references/outlook-env.sh (reported line 133)May include surrounding context.

sh
args=(-s -K "$rc_file" -X "$method" -H 'Accept: application/json'
        -o "$tmp" -w '%{http_code}' --max-time 60)
  http_status="$(curl "${args[@]}" "$@" "${OUTLOOK_API}${req_path}")" || {
    echo "curl failed" >&2; rm -f "$tmp"; return 1; }

  case "$http_status" in
    2*) cat "$tmp"; rm -f "$tmp"; return 0 ;;