SharePoint

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:16 AM UTC
• Version: 1.0.5

Overview

This SharePoint skill is coherent and disclosed, but it asks users to install and allowlist an unpinned external plugin that handles Microsoft OAuth and broad SharePoint write, delete, sharing, and permission operations.

Review the ClawLink plugin and OAuth consent carefully before installing. Use an account with the minimum SharePoint permissions needed, confirm every write or permission change, and prefer installing only if you accept a hosted third-party integration handling SharePoint requests and token refresh.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:45

Finding

Unpinned Third-Party Plugin Receives Privileged SharePoint Access

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 45-78
Vulnerability Type: Unpinned privileged third-party dependency
Risk Level: Medium

Vulnerable Code

markdown

Install the verified ClawLink plugin from ClawHub. After the user confirms, complete the full setup so ClawLink tools are visible in the next OpenClaw chat.

```bash
openclaw plugins install clawhub:clawlink-plugin
openclaw config set tools.alsoAllow '["clawlink-plugin"]' --strict-json
openclaw gateway restart

text

```markdown
All SharePoint tool calls are authenticated automatically by ClawLink using the user's connected Microsoft account via OAuth.

**No OAuth setup is required in chat.** ClawLink manages the OAuth flow and token refresh automatically.

### Getting Connected

1. Install the ClawLink plugin (see Install above).
2. Pair the plugin with `clawlink_begin_pairing` if it is not configured yet.
3. Open https://claw-link.dev/dashboard?add=sharepoint and connect SharePoint via OAuth.
4. Call `clawlink_list_integrations` to verify the connection is active.

Technical Analysis

The Skill instructs the agent to install a remotely resolved plugin by package name, allowlist it as a tool provider, and restart the OpenClaw gateway. It does not pin an immutable plugin version or content digest and provides no checksum or publisher-signature verification procedure.

The installed component is then entrusted with managed Microsoft OAuth credentials and authenticated SharePoint requests. Because the plugin implementation is not included in the audited project, its credential handling, network destinations, update behavior, OAuth scopes, and data-retention controls cannot be independently verified from this package.

The use of an external OAuth proxy is explicitly disclosed and is consistent with the Skill's advertised hosted-integration model. Therefore, the reviewed file does not establish covert data exfiltratio ...[truncated 2655 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the plugin to an immutable, reviewed version and preferably a cryptographic content digest rather than resolving only clawhub:clawlink-plugin.
2. Require verification of a publisher signature and package checksum before installation. Fail closed if verification cannot be completed.
3. Publish or vendor the relevant plugin source so credential handling, network destinations, update behavior, and tool implementations can be independently audited.
4. Document the exact Microsoft delegated OAuth scopes requested and reduce them to the minimum required for the operations the user enables.
5. Separate read-only and write-capable authorization profiles. Do not request permission-management, sharing, deletion, or site-administration scopes unless the user explicitly needs those capabilities.
6. Restrict the plugin's network access to documented ClawLink and Microsoft Graph endpoints and prevent communication with arbitrary destinations.
7. Store OAuth tokens in an OS-backed credential store, encrypt them at rest, avoid exposing them to chat or logs, and support prompt revocation.
8. Document data retention, telemetry collection, subprocessors, and whether SharePoint request or response content is persisted by the hosted proxy.
9. Preserve explicit user approval before plugin installation, OAuth authorization, sharing operations, permission changes, and destructive writes.
10. Replace broad plugin allowlisting with per-tool or per-capability authorization where supported, limiting exposure to the tools necessary for the current task.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.