OfficeClaw

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:49 PM UTC
• Version: 1.1.1

Overview

This skill is transparent about managing Microsoft mail, calendar, and tasks, but enabling outbound email can give an agent too much access to local files unless extra limits are configured.

Install only in an isolated environment, prefer pinning the package to the reviewed version, grant the minimum Microsoft Graph scopes, keep send/delete disabled unless needed, and if sending is enabled set both a recipient allowlist and OFFICECLAW_ALLOWED_ATTACHMENT_DIRS to a dedicated staging folder.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:24

Finding

Unpinned Third-Party Package Installation Permits Unaudited Future Releases

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 24-32
Vulnerability Type: Supply-chain exposure through an open-ended dependency version
Risk Level: Medium

Code Snippet:

bash

pip install --upgrade "officeclaw>=1.1.1"

Or with uv:

bash

uv pip install --upgrade "officeclaw>=1.1.1"

Verify the installed version:

bash

officeclaw --version   # expect 1.1.1 or newer

Technical Analysis

The installation instructions use an open-ended >=1.1.1 version constraint. This allows package managers to install any future OfficeClaw release rather than the version documented and reviewed by the Skill.

Because the project contains only SKILL.md, the installed package's source code is not available in the audited artifact. Its behavior, dependency tree, and security controls therefore cannot be verified here. A future malicious or compromised release could execute arbitrary Python code with the privileges of the user running the installation or CLI.

The package handles valuable security assets, including Microsoft OAuth tokens, email content, calendar data, task data, and local attachment files. This makes an unaudited package update particularly consequential.

Attack Path

1. An attacker compromises the package publisher account, release pipeline, package repository, or an upstream dependency.
2. The attacker publishes a malicious version greater than 1.1.1.
3. A user follows the documented command or repeats it during an upgrade.
4. The package manager resolves the constraint to the malicious future release.
5. Malicious installation-time or runtime code executes with the user's local privileges.
6. The compromised package can access readable local files, OfficeClaw token caches, environment variables, and Microsoft Graph data available through the authenticated account.

Impact Assessment

Successful exploitation could provide code execution u ...[truncated 696 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an exact audited version, such as officeclaw==1.1.1.
2. Publish and verify cryptographic hashes using a requirements file with hash checking.
3. Include a lockfile that pins all transitive dependencies.
4. Review the executable package source and dependency tree alongside the Skill documentation.
5. Perform upgrades as explicit security-reviewed changes rather than automatically accepting every newer release.
6. Prefer a trusted internal package mirror or signed release artifacts where available.
7. Run the CLI in an isolated environment with access only to the local files required for the requested operation.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:113

Finding

Attachment Uploads Can Read Sensitive Files Outside a Dedicated Staging Directory by Default

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 113-116
Vulnerability Type: Excessive local filesystem access for outbound attachments
Risk Level: High

Code Snippet:

text

⚠️ Attachment Directories (v1.1.0+): `mail send --attachment` can read any file this process can read. Set `OFFICECLAW_ALLOWED_ATTACHMENT_DIRS` to a dedicated drop directory (for example `~/.openclaw/workspace/wip`) and copy files there when you want them sent, so an agent cannot attach credentials or keys straight off disk.

The optional configuration is also shown at SKILL.md, lines 102-105:

bash

# Attachment directories — restricts which files can be attached or downloaded to
# OFFICECLAW_ALLOWED_ATTACHMENT_DIRS=~/.openclaw/workspace/wip

Technical Analysis

The documentation explicitly states that mail send --attachment can read any file readable by the OfficeClaw process. The attachment-directory control is recommended but commented out and optional. Consequently, enabling outbound email without separately configuring OFFICECLAW_ALLOWED_ATTACHMENT_DIRS leaves attachment selection bounded only by the operating-system permissions of the agent process.

Reading arbitrary user-accessible files is broader than the minimum privileges required to attach user-approved documents. In an AI-agent environment, untrusted email content, indirect prompt injection, ambiguous user instructions, or agent selection errors could cause a sensitive file to be chosen as an attachment.

The outbound-send capability is disabled by default and must be enabled with OFFICECLAW_ENABLE_SEND=true. This reduces exposure but does not eliminate the issue once sending is enabled. The recipient allowlist is also only strongly recommended rather than mandatory, so an unsafe deployment could lack both file-source and recipient restrictions.

The SSH path mentioned at line 214 is not itself an SSH-key write operation. It is a defensive file ...[truncated 2063 chars]

Remediation

View remediation

Remediation Suggestions

1. Make attachment upload default-deny unless OFFICECLAW_ALLOWED_ATTACHMENT_DIRS is explicitly configured.
2. Default the allowed source to a dedicated staging directory containing only user-approved outbound files.
3. Resolve canonical paths before validation and reject traversal, symlink, junction, and case-normalization escapes.
4. Require explicit user confirmation showing the canonical local path, recipient list, file size, and file type before transmission.
5. Require a non-empty recipient allowlist whenever sending is enabled in an agent deployment.
6. Reject known-sensitive file locations and formats, including SSH keys, token caches, .env files, credential stores, and browser profiles.
7. Run OfficeClaw under a sandboxed account with access only to its token cache and attachment staging directory.
8. Log successful attachment transmissions using metadata such as canonical source path, recipient, size, timestamp, and message ID while avoiding attachment-content logging.
9. Add automated tests for traversal, symlink escape, alternate path syntax, network paths, and race conditions between path validation and file opening.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 214)May include surrounding context.

md

2. **Safe senders**: with `OFFICECLAW_SAFE_SENDERS_ONLY=true`, only senders matching `OFFICECLAW_SAFE_SENDERS_LIST` (exact address, or `@domain.com` wildcard) can be downloaded from
3. **Size and type**: `OFFICECLAW_ATTACHMENT_MAX_SIZE_MB` (default 25) and `OFFICECLAW_ATTACHMENT_ALLOWED_TYPES` (default `*`). In `download-all`, an attachment that fails either is reported as skipped and the rest continue
4. **Destination**: when `OFFICECLAW_ALLOWED_ATTACHMENT_DIRS` is set, files can only be written inside it — including the path argument to `mail download`, so naming a path does not escape the boundary
5. **Filenames**: names come from the sender, so they are reduced to a bare, portable filename before writing (`../../.ssh/authorized_keys` becomes `authorized_keys`), and an existing file is never overwritten — a collision becomes `report (1).pdf`

Also worth knowing:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 405)May include surrounding context.

md

2. **Safe senders**: with `OFFICECLAW_SAFE_SENDERS_ONLY=true`, only senders matching `OFFICECLAW_SAFE_SENDERS_LIST` (exact address, or `@domain.com` wildcard) can be downloaded from
3. **Size and type**: `OFFICECLAW_ATTACHMENT_MAX_SIZE_MB` (default 25) and `OFFICECLAW_ATTACHMENT_ALLOWED_TYPES` (default `*`). In `download-all`, an attachment that fails either is reported as skipped and the rest continue
4. **Destination**: when `OFFICECLAW_ALLOWED_ATTACHMENT_DIRS` is set, files can only be written inside it — including the path argument to `mail download`, so naming a path does not escape the boundary
5. **Filenames**: names come from the sender, so they are reduced to a bare, portable filename before writing (`../../.ssh/authorized_keys` becomes `authorized_keys`), and an existing file is never overwritten — a collision becomes `report (1).pdf`

Also worth knowing:

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: officeclaw
description: Connect to personal Microsoft accounts via Microsoft Graph API to manage email, calendar events, and tasks. Use this skill when the user needs to read/write Outlook mail, manage calendar appointments, or handle Microsoft To Do tasks.
license: Apache-2.0
homepage: https://github.com/danielithomas/officeclaw
user-invocable: true

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 147)May include surrounding context.

md

### Task Management
- **List tasks**: "What's on my to-do list?", "Show incomplete tasks"
- **Create tasks**: "Add 'buy groceries' to my tasks", "Create a task to review report"
- **Complete tasks**: "Mark 'finish proposal' as done", "Complete all shopping tasks"

## Available Commands

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 402)May include surrounding context.

md

## Security & Privacy

- **Write operations disabled by default**: Send, reply, forward, and delete are all blocked unless explicitly enabled via `OFFICECLAW_ENABLE_SEND` and `OFFICECLAW_ENABLE_DELETE` environment variables. This prevents accidental or unauthorised write actions.
- **Recipient allowlist (v1.0.4+, extended in v1.1.0 and v1.1.1)**: When `OFFICECLAW_ALLOWED_RECIPIENTS` is set, outbound email is restricted to listed addresses only — on **every** path: send (including cc and bcc), reply, reply-all, forward, **calendar attendees** (an invitation is email), and the Python API. Blocked attempts are logged to `email-blocked.log` and an `email-alert.json` alert file is written for monitoring. If not set, a runtime warning is displayed on each send. **Strongly recommended for any AI agent deployment.**
- **Download location (v1.1.0+)**: with no `--dest`, files go to `OFFICECLAW_DOWNLOADS_DIR`, else `officeclaw_downloads/` inside the first allowed attachment directory, else inside the platform's Downloads folder. Saved names are made legal on Windows, macOS and Linux alike.
- **Attachment directories (v1.1.0+)**: `OFFICECLAW_ALLOWED_ATTACHMENT_DIRS` governs both directions — where files may be attached *from* and where downloads may be written *to*. Downloaded filenames are reduced to a bare name, so a message cannot steer a write with a name like `../../.ssh/authorized_keys`, and existing files are never overwritten.

Static analysis

No suspicious patterns detected.