ClawHub
Back to skill

Security audit

TinkerClaw Outlook

Security checks for vulnerabilities and agentic risk

Overview

This Outlook skill is sensitive but coherent: it uses a user-supplied Microsoft Graph token to read mail, manage drafts, and optionally export mailbox data as disclosed.

Use this only with a Microsoft Graph token scoped to the mail actions you need. Review all drafts manually before sending, treat generated mail summaries as untrusted because email content can contain deceptive instructions, and remove local plaintext exports when they are no longer needed.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

other

Warning
Location
scripts/outlook-mail-fetch.mjs:314
Finding

Indirect Prompt Injection Through Untrusted Mailbox Content in Generated Markdown

Content
View full analysis
| **Date:** ${d}\n`; if (attList && attList.length > 0) { md += `**Attachments:** ${attList.map(a => `${a.name} (${(a.size / 1024).toFixed(0)}KB)`).join(', ')}\n`; } md += `> ${(e.preview || '').slice(0, 250).replace(/\n/g, ' ')}\n\n`; } ``` ### Technical Analysis The generated `email-summary.md` incorporates externally controlled mailbox fields, including: - Message subjects - Sender names and addresses - Attachment names - Message previews These values are inserted directly into Markdown without escaping Markdown or HTML metacharacters, applying structural delimiters, or attaching provenance metadata that identifies them as untrusted data. An external sender can consequently place headings, links, HTML, or instruction-like text into the generated report. Although this does not directly execute operating-system code, it creates an indirect prompt-injection boundary when an AI Agent later reads or analyzes the report. The Agent may interpret mailbox content as instructions rather than as untrusted data. The preview is truncated and has newline characters replaced, but that does not neutralize prompt injection or inline Markdown/HTML. Subjects, sender fields, and attachment names are not similarly constrained in the displayed code. ### Attack Path 1. An attacker sends an email to the target mailbox. 2. The attacker places instruction-like content or crafted Markdown/HTML i ...[truncated 1354 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
scripts/outlook-mail-fetch.mjs:34
Finding

Time-of-Check to Time-of-Use Race in Private Export File Handling

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (12)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

md
One zero-dependency Node.js client: `scripts/outlook-mail-fetch.mjs`.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.

md
#!/usr/bin/env node
/**
 * outlook-mail-fetch.mjs — Fetch the signed-in user's Outlook mail via an MSAL refresh token.
 * Zero external deps. Uses Microsoft Graph with a short-lived access token supplied on stdin.
 * NOT read-only — the accurate statement of what this file can change:
 *   - NEVER SENDS. There is no send/reply/forward call anywhere in this file, by design.
 *   - WRITES: it can CREATE and PATCH (overwrite) message drafts via Microsoft Graph.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

md
#!/usr/bin/env node
/**
 * outlook-mail-fetch.mjs — Fetch the signed-in user's Outlook mail via an MSAL refresh token.
 * Zero external deps. Uses Microsoft Graph with a short-lived access token supplied on stdin.
 * NOT read-only — the accurate statement of what this file can change:
 *   - NEVER SENDS. There is no send/reply/forward call anywhere in this file, by design.
 *   - WRITES: it can CREATE and PATCH (overwrite) message drafts via Microsoft Graph.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

md
#!/usr/bin/env node
/**
 * outlook-mail-fetch.mjs — Fetch the signed-in user's Outlook mail via an MSAL refresh token.
 * Zero external deps. Uses Microsoft Graph with a short-lived access token supplied on stdin.
 * NOT read-only — the accurate statement of what this file can change:
 *   - NEVER SENDS. There is no send/reply/forward call anywhere in this file, by design.
 *   - WRITES: it can CREATE and PATCH (overwrite) message drafts via Microsoft Graph.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/outlook-mail-fetch.mjs (reported line 4)May include surrounding context.

js
#!/usr/bin/env node
/**
 * outlook-mail-fetch.mjs — Fetch the signed-in user's Outlook mail via an MSAL refresh token.
 * Zero external deps. Uses Microsoft Graph with a short-lived access token supplied on stdin.
 * NOT read-only — the accurate statement of what this file can change:
 *   - NEVER SENDS. There is no send/reply/forward call anywhere in this file, by design.
 *   - WRITES: it can CREATE and PATCH (overwrite) message drafts via Microsoft Graph.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/outlook-mail-fetch.mjs (reported line 9)May include surrounding context.

js
#!/usr/bin/env node
/**
 * outlook-mail-fetch.mjs — Fetch the signed-in user's Outlook mail via an MSAL refresh token.
 * Zero external deps. Uses Microsoft Graph with a short-lived access token supplied on stdin.
 * NOT read-only — the accurate statement of what this file can change:
 *   - NEVER SENDS. There is no send/reply/forward call anywhere in this file, by design.
 *   - WRITES: it can CREATE and PATCH (overwrite) message drafts via Microsoft Graph.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/outlook-mail-fetch.mjs (reported line 72)May include surrounding context.

js
#!/usr/bin/env node
/**
 * outlook-mail-fetch.mjs — Fetch the signed-in user's Outlook mail via an MSAL refresh token.
 * Zero external deps. Uses Microsoft Graph with a short-lived access token supplied on stdin.
 * NOT read-only — the accurate statement of what this file can change:
 *   - NEVER SENDS. There is no send/reply/forward call anywhere in this file, by design.
 *   - WRITES: it can CREATE and PATCH (overwrite) message drafts via Microsoft Graph.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/outlook-mail-fetch.mjs (reported line 74)May include surrounding context.

js
#!/usr/bin/env node
/**
 * outlook-mail-fetch.mjs — Fetch the signed-in user's Outlook mail via an MSAL refresh token.
 * Zero external deps. Uses Microsoft Graph with a short-lived access token supplied on stdin.
 * NOT read-only — the accurate statement of what this file can change:
 *   - NEVER SENDS. There is no send/reply/forward call anywhere in this file, by design.
 *   - WRITES: it can CREATE and PATCH (overwrite) message drafts via Microsoft Graph.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/outlook-mail-fetch.mjs (reported line 78)May include surrounding context.

js
#!/usr/bin/env node
/**
 * outlook-mail-fetch.mjs — Fetch the signed-in user's Outlook mail via an MSAL refresh token.
 * Zero external deps. Uses Microsoft Graph with a short-lived access token supplied on stdin.
 * NOT read-only — the accurate statement of what this file can change:
 *   - NEVER SENDS. There is no send/reply/forward call anywhere in this file, by design.
 *   - WRITES: it can CREATE and PATCH (overwrite) message drafts via Microsoft Graph.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/outlook-mail-fetch.mjs (reported line 94)May include surrounding context.

js
}
  });
  if (resp.status === 401 && !retried) {
    throw new Error('Access token expired; obtain a new short-lived token and retry');
  }
  if (!resp.ok) throw new Error(`Graph API ${resp.status}: ${await resp.text()}`);
  return resp.json();

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/outlook-mail-fetch.mjs (reported line 110)May include surrounding context.

js
}
  });
  if (resp.status === 401 && !retried) {
    throw new Error('Access token expired; obtain a new short-lived token and retry');
  }
  if (!resp.ok) throw new Error(`Graph API ${resp.status}: ${await resp.text()}`);
  return resp.json();

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.