Security audit
Security checks for vulnerabilities and agentic risk
This is a transparent Outlook calendar helper that uses Microsoft Graph with disclosed local token storage and explicit controls for calendar writes and deletes.
Install only if you are comfortable granting this skill offline_access, User.Read, and Calendars.ReadWrite for your Microsoft account. Treat ~/.outlook-calendar/ as sensitive, prefer interactive confirmation for real writes/deletes, and revoke or clear the token store when you no longer need the skill.
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
…and removes the temporary `device.json`.
> **Important:** never commit `~/.outlook-calendar/` to git. The `setup-device-code.sh`
> script refuses to overwrite existing files unless you pass `--force`.
## Reading events
Referenced artifact was not completely inspected
| `SKILL.md` | this file |
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
exit 0
fi
log_info "DELETE /me/events/$eid"
# Graph returns 204 No Content on successful delete
graph_request DELETE "/me/events/$eid" "" >/dev/null
log_info "deleted."
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
log_info "DELETE /me/events/$eid"
# Graph returns 204 No Content on successful delete
graph_request DELETE "/me/events/$eid" "" >/dev/null
log_info "deleted."
}
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
#!/usr/bin/env bash
# scripts/token.sh
# Inspect or refresh the Microsoft Graph access token used by outlook-calendar.
#
# Subcommands:
# status Show token presence & expiry (no token value ever printed).
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
#!/usr/bin/env bash
# scripts/token.sh
# Inspect or refresh the Microsoft Graph access token used by outlook-calendar.
#
# Subcommands:
# status Show token presence & expiry (no token value ever printed).
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
#!/usr/bin/env bash
# scripts/token.sh
# Inspect or refresh the Microsoft Graph access token used by outlook-calendar.
#
# Subcommands:
# status Show token presence & expiry (no token value ever printed).
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
#!/usr/bin/env bash
# scripts/token.sh
# Inspect or refresh the Microsoft Graph access token used by outlook-calendar.
#
# Subcommands:
# status Show token presence & expiry (no token value ever printed).
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
#!/usr/bin/env bash
# scripts/token.sh
# Inspect or refresh the Microsoft Graph access token used by outlook-calendar.
#
# Subcommands:
# status Show token presence & expiry (no token value ever printed).
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
#!/usr/bin/env bash
# scripts/token.sh
# Inspect or refresh the Microsoft Graph access token used by outlook-calendar.
#
# Subcommands:
# status Show token presence & expiry (no token value ever printed).
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
#!/usr/bin/env bash
# scripts/token.sh
# Inspect or refresh the Microsoft Graph access token used by outlook-calendar.
#
# Subcommands:
# status Show token presence & expiry (no token value ever printed).
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
#!/usr/bin/env bash
# scripts/token.sh
# Inspect or refresh the Microsoft Graph access token used by outlook-calendar.
#
# Subcommands:
# status Show token presence & expiry (no token value ever printed).
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
#!/usr/bin/env bash
# scripts/token.sh
# Inspect or refresh the Microsoft Graph access token used by outlook-calendar.
#
# Subcommands:
# status Show token presence & expiry (no token value ever printed).
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
#!/usr/bin/env bash
# scripts/token.sh
# Inspect or refresh the Microsoft Graph access token used by outlook-calendar.
#
# Subcommands:
# status Show token presence & expiry (no token value ever printed).
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
#!/usr/bin/env bash
# scripts/token.sh
# Inspect or refresh the Microsoft Graph access token used by outlook-calendar.
#
# Subcommands:
# status Show token presence & expiry (no token value ever printed).
The script documentation explicitly states that status uses User.Read to validate the token, indicating the skill depends on a permission outside its declared calendar-only access model. This is dangerous because it grants unnecessary access to user profile information and undermines least-privilege expectations for a calendar-scoped skill.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
printf ' \033[33m…\033[0m shellcheck: %s has advisories (see /tmp/sc.%s)\n' "$s" "$$"
fi
done
rm -f /tmp/sc.$$
else
printf ' (shellcheck not installed; skipping)\n'
fi
Without declared permissions the skill's intent is opaque and cannot be validated.
The skill intentionally persists OAuth credentials in its own token store so it can continue accessing the user's calendar without repeating interactive login. Persistent refresh-token storage creates a standing credential target: if the local account, home directory, backups, or endpoint are compromised, an attacker may be able to obtain ongoing calendar read/write access until the token is revoked.
name: outlook-calendar
license: MIT
description: |
Read and write the signed-in user's Microsoft 365 / Outlook.com personal calendar via Microsoft Graph.
Calendar API surface only with a calendar-scoped device-code login and its own token store.
Use when the user wants to list today's events, look at next week, create / update / delete
a single event by id, or check token status. Trigger keywords: "outlook calendar", "ms calendar",
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
## ⚠️ Safety rules (read these before any write/delete)
1. **Every write is a two-step confirm.** `calendar-write.sh` defaults to **dry-run**: it
prints the JSON payload it *would* send and exits 0. To actually call Graph you must
pass **`--apply`**, and the script will then ask you to type `YES` at the terminal
(or pass `--yes` for non-interactive use). There is no implicit write and **no
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
3. **No secrets in logs.** `access_token` and `refresh_token` are never echoed to stdout
or stderr. Error responses are sanitized: any field whose name contains
`token`, `refresh`, `access`, `secret`, or `password` is replaced with `[REDACTED]`.
4. **Token & config live under `~/.outlook-calendar/`** (chmod 700 dir, chmod 600 files).
The `clear` subcommand of `token.sh` removes them — it requires `--yes-i-really-mean-it`.
## First-time setup
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
3. **No secrets in logs.** `access_token` and `refresh_token` are never echoed to stdout
or stderr. Error responses are sanitized: any field whose name contains
`token`, `refresh`, `access`, `secret`, or `password` is replaced with `[REDACTED]`.
4. **Token & config live under `~/.outlook-calendar/`** (chmod 700 dir, chmod 600 files).
The `clear` subcommand of `token.sh` removes them — it requires `--yes-i-really-mean-it`.
## First-time setup
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
3. **No secrets in logs.** `access_token` and `refresh_token` are never echoed to stdout
or stderr. Error responses are sanitized: any field whose name contains
`token`, `refresh`, `access`, `secret`, or `password` is replaced with `[REDACTED]`.
4. **Token & config live under `~/.outlook-calendar/`** (chmod 700 dir, chmod 600 files).
The `clear` subcommand of `token.sh` removes them — it requires `--yes-i-really-mean-it`.
## First-time setup
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
3. **No secrets in logs.** `access_token` and `refresh_token` are never echoed to stdout
or stderr. Error responses are sanitized: any field whose name contains
`token`, `refresh`, `access`, `secret`, or `password` is replaced with `[REDACTED]`.
4. **Token & config live under `~/.outlook-calendar/`** (chmod 700 dir, chmod 600 files).
The `clear` subcommand of `token.sh` removes them — it requires `--yes-i-really-mean-it`.
## First-time setup
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
3. **No secrets in logs.** `access_token` and `refresh_token` are never echoed to stdout
or stderr. Error responses are sanitized: any field whose name contains
`token`, `refresh`, `access`, `secret`, or `password` is replaced with `[REDACTED]`.
4. **Token & config live under `~/.outlook-calendar/`** (chmod 700 dir, chmod 600 files).
The `clear` subcommand of `token.sh` removes them — it requires `--yes-i-really-mean-it`.
## First-time setup
No suspicious patterns detected.