ClawHub
Back to skill

Security audit

outlook-contacts

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Outlook contacts tool that uses Microsoft Graph with contact-focused permissions and visible user controls for writes.

Install only if you are comfortable granting this skill persistent read/write access to your Outlook/Microsoft 365 personal contacts. Keep ~/.outlook-contacts out of backups and repositories, and use scripts/token.sh clear --yes-i-really-mean-it or revoke the Microsoft app consent if you no longer need it.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
This contacts-scoped helper library contains calendar event construction and confirmation utilities that are unrelated to the declared skill purpose. In an agent/tooling context, extra write-oriented capabilities expand the attack surface and can be invoked by other scripts or future changes, undermining least privilege and creating a skill-description/implementation mismatch.

Scope Creep

Medium
Confidence
94% confidence
Finding
The default scopes include Microsoft Graph User.Read in addition to Contacts.ReadWrite, despite the skill description claiming contacts-scoped access only. This over-requests permissions relative to stated functionality, violating least privilege and increasing the amount of user data accessible if the token is misused or the skill is extended unexpectedly.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
This script retrieves and prints personal contact data including names, email addresses, phone numbers, company, and job title directly to stdout/stderr without any privacy warning, redaction, or confirmation step. In an agent setting, that increases the risk of unintended disclosure through logs, terminal history, screenshots, downstream tool chaining, or display to a user who did not clearly request full contact details.

Session Persistence

Medium
Category
Rogue Agent
Content
name: outlook-contacts
license: MIT
description: |
  Read and write the signed-in user's Microsoft 365 / Outlook.com personal contacts via Microsoft Graph.
  No mail, no files, no directory access. This skill has its own contacts-scoped device-code
  login and token store.
  Use when the user wants to list/search Outlook.com contacts, find phone numbers, or look up email addresses.
Confidence
88% confidence
Finding
The skill explicitly maintains a persistent token store under ~/.outlook-contacts/, including refresh tokens for offline_access. Persistent delegated credentials increase risk because compromise of the local account, home directory backups, or misconfigured permissions could allow continued unauthorized access to the user's contacts without re-prompting for authentication.

Session Persistence

Medium
Category
Rogue Agent
Content
#   2. Requests exactly the minimal contacts consent set (documented in SKILL.md):
#         offline_access
#         https://graph.microsoft.com/User.Read
#         https://graph.microsoft.com/Contacts.ReadWrite
#      No shared family token store, no calendar or To Do scopes, no mail,
#      no files, no directory scopes — ever.
#   3. Calls the /devicecode endpoint and prints a short user code + verification URL.
Confidence
84% confidence
Finding
The script intentionally persists OAuth access and refresh tokens to disk, creating a durable authenticated session. Even with chmod 600, local token storage increases the blast radius of host compromise, malware running as the same user, accidental backup/sync leakage, or insecure helper implementations. In this contacts skill context the scope is narrower than full mailbox access, which lowers severity, but Contacts.ReadWrite plus offline_access still grants persistent access to personal contact data.

Static analysis

No suspicious patterns detected.