outlook-calendar

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 2:30 PM UTC
• Version: 1.0.9

Overview

This is a disclosed Outlook calendar integration that stores Microsoft Graph tokens locally and can edit calendar events only through explicit apply/confirmation controls.

Install only if you are comfortable granting this skill read/write access to your Outlook calendar and keeping a reusable Microsoft refresh token under ~/.outlook-calendar/. Use dry-run output before applying writes, avoid --yes unless you intentionally want non-interactive changes, and clear or revoke the tokens when you no longer need the skill.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (43)

Self-Modification

High

• Category: Rogue Agent

Content

…and removes the temporary `device.json`.

> **Important:** never commit `~/.outlook-calendar/` to git. The `setup-device-code.sh`
> script refuses to overwrite existing files unless you pass `--force`.

## Reading events

• Confidence: 85% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Ae1

High

• Category: analysis-evasion

Content

| `SKILL.md` | this file |

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

exit 0
    fi

    log_info "DELETE /me/events/$eid"
    # Graph returns 204 No Content on successful delete
    graph_request DELETE "/me/events/$eid" "" >/dev/null
    log_info "deleted."

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

log_info "DELETE /me/events/$eid"
    # Graph returns 204 No Content on successful delete
    graph_request DELETE "/me/events/$eid" "" >/dev/null
    log_info "deleted."
}

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Credential Access

High

• Category: Privilege Escalation

Content

#!/usr/bin/env bash
# scripts/token.sh
# Inspect or refresh the Microsoft Graph access token used by outlook-calendar.
#
# Subcommands:
#   status    Show token presence & expiry (no token value ever printed).

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

#!/usr/bin/env bash
# scripts/token.sh
# Inspect or refresh the Microsoft Graph access token used by outlook-calendar.
#
# Subcommands:
#   status    Show token presence & expiry (no token value ever printed).

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

#!/usr/bin/env bash
# scripts/token.sh
# Inspect or refresh the Microsoft Graph access token used by outlook-calendar.
#
# Subcommands:
#   status    Show token presence & expiry (no token value ever printed).

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

#!/usr/bin/env bash
# scripts/token.sh
# Inspect or refresh the Microsoft Graph access token used by outlook-calendar.
#
# Subcommands:
#   status    Show token presence & expiry (no token value ever printed).

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

#!/usr/bin/env bash
# scripts/token.sh
# Inspect or refresh the Microsoft Graph access token used by outlook-calendar.
#
# Subcommands:
#   status    Show token presence & expiry (no token value ever printed).

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

#!/usr/bin/env bash
# scripts/token.sh
# Inspect or refresh the Microsoft Graph access token used by outlook-calendar.
#
# Subcommands:
#   status    Show token presence & expiry (no token value ever printed).

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

#!/usr/bin/env bash
# scripts/token.sh
# Inspect or refresh the Microsoft Graph access token used by outlook-calendar.
#
# Subcommands:
#   status    Show token presence & expiry (no token value ever printed).

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

#!/usr/bin/env bash
# scripts/token.sh
# Inspect or refresh the Microsoft Graph access token used by outlook-calendar.
#
# Subcommands:
#   status    Show token presence & expiry (no token value ever printed).

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

#!/usr/bin/env bash
# scripts/token.sh
# Inspect or refresh the Microsoft Graph access token used by outlook-calendar.
#
# Subcommands:
#   status    Show token presence & expiry (no token value ever printed).

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

#!/usr/bin/env bash
# scripts/token.sh
# Inspect or refresh the Microsoft Graph access token used by outlook-calendar.
#
# Subcommands:
#   status    Show token presence & expiry (no token value ever printed).

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

#!/usr/bin/env bash
# scripts/token.sh
# Inspect or refresh the Microsoft Graph access token used by outlook-calendar.
#
# Subcommands:
#   status    Show token presence & expiry (no token value ever printed).

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

printf '  \033[33m…\033[0m shellcheck: %s has advisories (see /tmp/sc.%s)\n' "$s" "$$"
        fi
    done
    rm -f /tmp/sc.$$
else
    printf '  (shellcheck not installed; skipping)\n'
fi

• Confidence: 95% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Session Persistence

Medium

• Category: Rogue Agent

Content

name: outlook-calendar
license: MIT
description: |
  Read and write the signed-in user's Microsoft 365 / Outlook.com personal calendar via Microsoft Graph.
  Calendar API surface only with a calendar-scoped device-code login and its own token store.
  Use when the user wants to list today's events, look at next week, create / update / delete
  a single event by id, or check token status. Trigger keywords: "outlook calendar", "ms calendar",

• Confidence: 83% confidence
• Finding: The skill deliberately persists OAuth tokens in `~/.outlook-calendar/` so it can operate headlessly against the user's calendar. Persistent delegated credentials increase the blast radius of any local compromise: malware, another local user, or a backup/logging leak could reuse the refresh token to maintain ongoing access to calendar data and perform writes or deletions.

Session Persistence

Medium

• Category: Rogue Agent

Content

## ⚠️ Safety rules (read these before any write/delete)

1. **Every write is a two-step confirm.** `calendar-write.sh` defaults to **dry-run**: it
   prints the JSON payload it *would* send and exits 0. To actually call Graph you must
   pass **`--apply`**, and the script will then ask you to type `YES` at the terminal
   (or pass `--yes` for non-interactive use). There is no implicit write and **no

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

3. **No secrets in logs.** `access_token` and `refresh_token` are never echoed to stdout
   or stderr. Error responses are sanitized: any field whose name contains
   `token`, `refresh`, `access`, `secret`, or `password` is replaced with `[REDACTED]`.
4. **Token & config live under `~/.outlook-calendar/`** (chmod 700 dir, chmod 600 files).
   The `clear` subcommand of `token.sh` removes them — it requires `--yes-i-really-mean-it`.

## First-time setup

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

3. **No secrets in logs.** `access_token` and `refresh_token` are never echoed to stdout
   or stderr. Error responses are sanitized: any field whose name contains
   `token`, `refresh`, `access`, `secret`, or `password` is replaced with `[REDACTED]`.
4. **Token & config live under `~/.outlook-calendar/`** (chmod 700 dir, chmod 600 files).
   The `clear` subcommand of `token.sh` removes them — it requires `--yes-i-really-mean-it`.

## First-time setup

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

3. **No secrets in logs.** `access_token` and `refresh_token` are never echoed to stdout
   or stderr. Error responses are sanitized: any field whose name contains
   `token`, `refresh`, `access`, `secret`, or `password` is replaced with `[REDACTED]`.
4. **Token & config live under `~/.outlook-calendar/`** (chmod 700 dir, chmod 600 files).
   The `clear` subcommand of `token.sh` removes them — it requires `--yes-i-really-mean-it`.

## First-time setup

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

3. **No secrets in logs.** `access_token` and `refresh_token` are never echoed to stdout
   or stderr. Error responses are sanitized: any field whose name contains
   `token`, `refresh`, `access`, `secret`, or `password` is replaced with `[REDACTED]`.
4. **Token & config live under `~/.outlook-calendar/`** (chmod 700 dir, chmod 600 files).
   The `clear` subcommand of `token.sh` removes them — it requires `--yes-i-really-mean-it`.

## First-time setup

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

3. **No secrets in logs.** `access_token` and `refresh_token` are never echoed to stdout
   or stderr. Error responses are sanitized: any field whose name contains
   `token`, `refresh`, `access`, `secret`, or `password` is replaced with `[REDACTED]`.
4. **Token & config live under `~/.outlook-calendar/`** (chmod 700 dir, chmod 600 files).
   The `clear` subcommand of `token.sh` removes them — it requires `--yes-i-really-mean-it`.

## First-time setup

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

The setup script requests exactly these delegated Microsoft Graph scopes:
`offline_access`, `User.Read`, `Calendars.ReadWrite`. No other scopes are requested.

For personal Outlook.com accounts, manually adding Graph API permissions in Azure Portal is usually optional. The setup script requests delegated scopes during login, and Microsoft can grant them via dynamic user consent. For work/school tenants that disable user consent, an administrator may still need to preconfigure permissions and grant admin consent.

```bash
cd ~/.openclaw/skills/outlook-calendar

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Static analysis

No suspicious patterns detected.