ClawHub
Back to skill

Security audit

Build Teams.ai Apps with Anthropic Claude

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent setup guide for connecting Teams.ai apps to Anthropic and optional You.com search, with normal integration risks users should manage.

Before installing, use reviewed and pinned npm versions, keep .env files out of source control, scope and rotate API keys, and confirm your organization permits Teams messages or retrieved content to be processed by Anthropic and You.com.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:45
Finding

Unpinned npm Dependencies Create a Supply-Chain Execution Risk

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 45, 145, 226, 371, and 395
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

The installation instructions use npm package names without exact versions and do not require a reviewed lockfile.

bash
# SKILL.md:45
npm install @youdotcom-oss/teams-anthropic @anthropic-ai/sdk @microsoft/teams.ai
bash
# SKILL.md:145
npm install @youdotcom-oss/teams-anthropic @anthropic-ai/sdk @microsoft/teams.ai @microsoft/teams.mcpclient
bash
# SKILL.md:226
npm install @microsoft/teams.mcpclient
bash
# SKILL.md:371
npm install @youdotcom-oss/teams-anthropic @anthropic-ai/sdk
bash
# SKILL.md:395
npm install @microsoft/teams.mcpclient

Technical Analysis

These commands allow npm to resolve package versions at installation time. The resolved code can therefore differ from the version originally reviewed or tested. The project contains no lockfile or package manifest that constrains the selected versions.

npm dependencies may execute lifecycle scripts during installation and run with the privileges of the user performing the installation. If an upstream maintainer account, package release process, or transitive dependency is compromised, a malicious release selected by these commands could execute arbitrary code. There is no evidence that the named packages are currently malicious; the issue is the absence of controls that make dependency installation reproducible and resistant to unexpected upstream changes.

Attack Path

  1. An attacker compromises an upstream package, maintainer account, release pipeline, or transitive dependency.
  2. The attacker publishes a malicious version that remains compatible with npm's unconstrained resolution.
  3. A user follows one of the documented npm install commands.
  4. npm selects and downloads the malicious version.
  5. Malicious code executes through an ...[truncated 913 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin every direct dependency to an exact, reviewed version rather than relying on npm's current resolution:
    bash
    npm install --save-exact package-name@reviewed-version
  2. Generate, review, and commit package-lock.json.
  3. In automated and reproducible environments, install dependencies with:
    bash
    npm ci
  4. Review transitive dependencies and package provenance before approving lockfile changes.
  5. Run npm audit or an equivalent software-composition analysis tool in CI, while manually evaluating relevant findings.
  6. Use automated dependency updates only through reviewed pull requests with test and lockfile diffs.
  7. Inspect dependency lifecycle scripts and consider installing with --ignore-scripts where lifecycle scripts are unnecessary.
  8. Perform installation and runtime operations under a dedicated, least-privileged account with narrowly scoped credentials.
  9. Avoid exposing production API keys during dependency installation; provide secrets only to the runtime process that requires them.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (7)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

Get your API key from console.anthropic.com

bash
# Add to .env
ANTHROPIC_API_KEY=your-anthropic-api-key

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 154)May include surrounding context.

Get your API key from console.anthropic.com

bash
# Add to .env
ANTHROPIC_API_KEY=your-anthropic-api-key

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 375)May include surrounding context.

text

**"ANTHROPIC_API_KEY environment variable is required"**
- Get key from: https://console.anthropic.com/
- Add to .env: `ANTHROPIC_API_KEY=your-key-here`

**"Invalid model identifier"**

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 385)May include surrounding context.

text

**"ANTHROPIC_API_KEY environment variable is required"**
- Get key from: https://console.anthropic.com/
- Add to .env: `ANTHROPIC_API_KEY=your-key-here`

**"Invalid model identifier"**

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill advertises web search and content extraction via You.com MCP but does not warn that user prompts, fetched URLs, and extracted content may be transmitted to external third-party services. In an enterprise Teams context, users may unknowingly send sensitive corporate data outside tenant-controlled boundaries, creating privacy, compliance, and data-handling risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

The skill explicitly configures an external endpoint at api.you.com/mcp and notes bearer-token authentication and telemetry-bearing user-agent behavior. External transmission is expected for this integration, but without nearby trust-boundary and data-sharing warnings, developers may not appreciate that Teams content and metadata can leave the local application environment.

Content

Scanner excerpt · SKILL.md (reported line 401)May include surrounding context.

md
## getYouMcpConfig() Utility

Automatically configures You.com MCP connection:
- **URL**: `https://api.you.com/mcp`
- **Authentication**: Bearer token from `YDC_API_KEY`
- **User-Agent**: Includes package version for telemetry

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The documentation tells users to place API credentials in a .env file without any warning about secure secret handling, accidental commits, rotation, or production secret storage. While .env usage is common for local development, omission of basic safeguards can lead to credential leakage through source control or misconfigured deployments.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.