Microsoft 365 Integration

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:38 AM UTC
• Version: 1.0.0

Overview

This Microsoft 365 skill is purpose-aligned but needs review because it grants broad account access and runs an unpinned npm package at runtime.

Review this before installing. Use a least-privilege Microsoft app registration, prefer read-only mode unless writes are needed, pin or preinstall the npm dependency from a trusted version, and require explicit user confirmation before sending email, posting messages, deleting data, or creating/updating events and tasks.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: ms365_cli.py:37

Finding

Automatic Execution of an Unpinned npm Dependency

Content

View full analysis

Vulnerability Details

File Location: ms365_cli.py:37-43 and ms365_cli.py:78
Vulnerability Type: Unpinned third-party package execution through npx -y
Risk Level: High

Vulnerable Code

python

result = subprocess.run(
    ["npx", "-y", "@softeria/ms-365-mcp-server"],
    input=input_data,
    capture_output=True,
    text=True,
    timeout=60
)

python

def cmd_login(args):
    """Login via device code flow."""
    print("Starting device code login...")
    subprocess.run(["npx", "-y", "@softeria/ms-365-mcp-server", "--login"])

Technical Analysis

Every Microsoft 365 operation launches @softeria/ms-365-mcp-server by package name without an exact version, lockfile, or integrity verification. The -y option permits npx to install the selected registry version without interactive confirmation. Consequently, the code reviewed in this project does not fully determine the code executed at runtime.

If the npm publisher account, package, registry resolution process, or transitive dependency chain is compromised, a malicious release could be retrieved and executed automatically. The child process inherits the invoking user's environment by default. This may include the documented MS365_MCP_CLIENT_ID, MS365_MCP_CLIENT_SECRET, and MS365_MCP_TENANT_ID variables, as well as other credentials available in that environment.

The process also runs with the local privileges of the user invoking the CLI. Following authentication, the dependency mediates access to Microsoft Graph and cached authentication material.

Attack Path

1. An attacker compromises the npm package publisher, package distribution channel, or a transitive dependency.
2. The attacker publishes a malicious version that remains compatible with unversioned package resolution.
3. A user invokes login, status, or any Microsoft 365 data command.
4. npx -y @softeria/ms-365-mcp-server resolves and, when necessary, downloads the unpinned package without c ...[truncated 1027 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a reviewed exact version rather than using an unversioned package name.
2. Declare the package in package.json and commit a generated lockfile.
3. Install dependencies during a controlled deployment phase with npm ci, not dynamically during each request.
4. Remove npx -y runtime auto-installation. Invoke a previously installed, verified local executable instead.
5. Enforce npm integrity checks and use a trusted registry. Consider package signature or provenance verification in CI.
6. Continuously scan the pinned package and its transitive dependencies for known vulnerabilities and unexpected ownership or release changes.
7. Launch the server with a minimal, explicitly constructed environment rather than inheriting all parent environment variables.
8. Store client secrets in an appropriate secret manager and avoid exposing them to processes that do not require them.
9. Apply least-privilege Microsoft Graph scopes and disable optional organization permissions unless necessary.
10. Run the MCP server in a sandboxed, non-privileged environment with restricted filesystem and network access.
11. Review and approve dependency updates before deployment, including source and behavioral changes.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README advertises broad read/write/delete access to email, calendar, files, tasks, chats, and SharePoint data without an upfront warning that the skill can perform destructive and privacy-sensitive actions. In an agent setting, this increases the risk that users enable a powerful integration without understanding that it can exfiltrate sensitive content or modify/delete data across Microsoft 365 services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The usage section encourages users to issue natural-language commands like sending email or adding tasks, but it does not warn that free-form agent interpretation can trigger unintended write operations. In an LLM-integrated environment, ambiguous prompts can lead to accidental outbound communications or state changes in a user's Microsoft 365 account.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The activation terms are broad enough to match many ordinary conversations about Microsoft, email, meetings, or tasks, which can cause the skill to activate outside clear user intent. In a skill that can read mail, list files, create calendar events, and send email, over-triggering increases the chance of unintended access to sensitive data or unintended state-changing actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This skill performs sensitive read and write operations against Microsoft 365 accounts, including email, calendar, files, tasks, and contacts, but the description does not clearly warn users that it can access, modify, and transmit account data. Lack of transparent disclosure increases the risk of users authorizing impactful actions without understanding the privacy and account consequences.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This command can send outbound email immediately with attacker- or model-controlled arguments and provides no confirmation, preview, or safety interlock before the external action occurs. In an agent skill context, that makes prompt-induced or accidental data exfiltration and unauthorized communication materially more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

Creating calendar events is an external side effect that modifies the user's account state, yet the command executes without any user-facing confirmation or dry-run preview. In an agent setting this can be abused to create misleading meetings, spam invites, or silently alter a user's schedule.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The code defaults calendar event times to America/Chicago when no timezone is explicitly supplied, which can silently create events at incorrect times for users in other regions. This is primarily an integrity and usability risk, but in scheduling workflows it can cause missed meetings or social engineering opportunities through deceptive timing.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

Task creation hard-codes America/Chicago for dueDateTime, which can shift deadlines unexpectedly for users outside that timezone. While not a code execution issue, it can lead to incorrect reminders and unintended task timing in a cross-timezone account context.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.