Security audit
Security checks for vulnerabilities and agentic risk
The skill is disclosed as an Outlook contacts manager and its active commands match that purpose, though it stores Microsoft tokens locally and includes unused calendar helper code.
Install only if you are comfortable granting Contacts.ReadWrite, offline_access, and User.Read to the configured Microsoft app. Treat ~/.outlook-contacts/tokens.json as sensitive, use token.sh clear when finished, and prefer reviewing/removing the unused event helper code before broad deployment.
The finding indicates the underlying skill code may expose broader Microsoft Graph functionality than the description claims, including generic Graph requests and calendar/event helpers. If true, users may grant trust and OAuth consent believing the skill is contacts-only while the implementation can access or manipulate other Graph resources, creating a privilege-boundary and transparency failure.
The finding indicates the underlying skill code may expose broader Microsoft Graph functionality than the description claims, including generic Graph requests and calendar/event helpers. If true, users may grant trust and OAuth consent believing the skill is contacts-only while the implementation can access or manipulate other Graph resources, creating a privilege-boundary and transparency failure.
Referenced artifact was not completely inspected
| `SKILL.md` | this file |
This function explicitly constructs calendar event request bodies even though the skill is presented as contacts-only. In context, that is a strong capability-mismatch signal: it enables non-declared write operations to another data domain and could be paired with Graph request helpers to create events without clear user expectation or consent boundaries.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
#!/usr/bin/env bash
# scripts/token.sh
# Inspect or refresh the Microsoft Graph access token used by outlook-contacts.
#
# Subcommands:
# status Show token presence & expiry (no token value ever printed).
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
#!/usr/bin/env bash
# scripts/token.sh
# Inspect or refresh the Microsoft Graph access token used by outlook-contacts.
#
# Subcommands:
# status Show token presence & expiry (no token value ever printed).
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
#!/usr/bin/env bash
# scripts/token.sh
# Inspect or refresh the Microsoft Graph access token used by outlook-contacts.
#
# Subcommands:
# status Show token presence & expiry (no token value ever printed).
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
#!/usr/bin/env bash
# scripts/token.sh
# Inspect or refresh the Microsoft Graph access token used by outlook-contacts.
#
# Subcommands:
# status Show token presence & expiry (no token value ever printed).
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
#!/usr/bin/env bash
# scripts/token.sh
# Inspect or refresh the Microsoft Graph access token used by outlook-contacts.
#
# Subcommands:
# status Show token presence & expiry (no token value ever printed).
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
#!/usr/bin/env bash
# scripts/token.sh
# Inspect or refresh the Microsoft Graph access token used by outlook-contacts.
#
# Subcommands:
# status Show token presence & expiry (no token value ever printed).
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
#!/usr/bin/env bash
# scripts/token.sh
# Inspect or refresh the Microsoft Graph access token used by outlook-contacts.
#
# Subcommands:
# status Show token presence & expiry (no token value ever printed).
The script explicitly documents use of User.Read to confirm the token works, but the skill metadata says it has no directory or broader profile access and is limited to contacts. Requesting or depending on an undeclared scope is a significant security issue because it violates least privilege and can grant access to additional account profile information beyond the user's expectations.
Without declared permissions the skill's intent is opaque and cannot be validated.
The skill explicitly stores access and refresh tokens under ~/.outlook-contacts/, creating persistent session material on disk. Even with contacts-scoped access, compromise of the local account or token files could allow unauthorized reading, modification, or deletion of the user's personal contacts without repeating interactive login.
name: outlook-contacts
license: MIT
description: |
Read and write the signed-in user's Microsoft 365 / Outlook.com personal contacts via Microsoft Graph.
No mail, no files, no directory access. This skill has its own contacts-scoped device-code
login and token store.
Use when the user wants to list/search Outlook.com contacts, find phone numbers, or look up email addresses.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
| `https://graph.microsoft.com/User.Read` | display signed-in account UPN |
| `https://graph.microsoft.com/Contacts.ReadWrite` | read and write personal contacts |
All write operations (create, update, delete) default to **dry-run**; you must pass `--apply` to execute.
## ⚠️ Safety rules
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
1. **Every write defaults to dry-run.** Pass `--apply` to execute. Create/update print the JSON payload first.
2. **Delete always shows the contact first**, then asks for a typed `YES` confirmation (or `--yes` for non-interactive use).
3. **No secrets in logs.** Tokens are never echoed; error bodies are sanitized.
4. **Token & config live under `~/.outlook-contacts/`** (chmod 700 dir, chmod 600 files).
## First-time setup
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
1. **Every write defaults to dry-run.** Pass `--apply` to execute. Create/update print the JSON payload first.
2. **Delete always shows the contact first**, then asks for a typed `YES` confirmation (or `--yes` for non-interactive use).
3. **No secrets in logs.** Tokens are never echoed; error bodies are sanitized.
4. **Token & config live under `~/.outlook-contacts/`** (chmod 700 dir, chmod 600 files).
## First-time setup
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
1. **Every write defaults to dry-run.** Pass `--apply` to execute. Create/update print the JSON payload first.
2. **Delete always shows the contact first**, then asks for a typed `YES` confirmation (or `--yes` for non-interactive use).
3. **No secrets in logs.** Tokens are never echoed; error bodies are sanitized.
4. **Token & config live under `~/.outlook-contacts/`** (chmod 700 dir, chmod 600 files).
## First-time setup
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
1. **Every write defaults to dry-run.** Pass `--apply` to execute. Create/update print the JSON payload first.
2. **Delete always shows the contact first**, then asks for a typed `YES` confirmation (or `--yes` for non-interactive use).
3. **No secrets in logs.** Tokens are never echoed; error bodies are sanitized.
4. **Token & config live under `~/.outlook-contacts/`** (chmod 700 dir, chmod 600 files).
## First-time setup
The helper library contains calendar/event-related functionality despite the skill being declared as contacts-only. In a least-privilege security model, unused cross-domain capabilities are dangerous because they can be invoked by companion scripts or future changes to perform actions outside the advertised scope, undermining user trust and making hidden scope creep harder to detect.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
}
_lib__require_bin jq
_lib__require_bin curl
# python3 is preferred for some pretty-printer paths; warn if missing
if ! command -v python3 >/dev/null 2>&1; then
echo "outlook-contacts: warning: python3 not found, table formatting will fall back to jq" >&2
The default scopes include User.Read in addition to Contacts.ReadWrite, which exceeds the skill's stated purpose of personal contacts access. Even if User.Read is commonly used for bootstrap identity calls, it still expands the permission footprint beyond the manifest claim and creates avoidable over-privilege if tokens are misused or the skill is extended.
Date/time helpers are part of a broader event/calendar capability set that is unjustified for a contacts skill. While the functions are not directly harmful alone, in this context they indicate hidden support for off-purpose operations and make it easier to add or conceal non-contact workflows under a contacts-scoped package.
The event summary helper supports confirmation flows for calendar operations that do not belong in a contacts-only skill. Its presence reinforces that the package is prepared for undeclared event creation or modification workflows, which increases the risk of hidden or accidental cross-purpose actions.
The script performs an HTTP request to Microsoft Graph to retrieve the signed-in user's contacts, which includes personal data such as names, email addresses, phone numbers, company, title, and notes. While there is a technical comment and a log of the GET URL, there is no explicit user-facing warning or confirmation that personal contact data will be transmitted to an external service during execution.
No suspicious patterns detected.