T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:10- Finding
Overbroad mandatory activation causes unnecessary calendar access
- Content
View full analysis
- Remediation
View remediation
Security audit
Outlook Calendar (M365)
Security checks for vulnerabilities and agentic risk
Overview
This Outlook calendar skill is not clearly malicious, but it handles Microsoft account credentials and reusable session material in risky plaintext files and can activate too broadly.
Review before installing. Use only in an isolated, trusted environment and avoid storing a primary Microsoft password in ~/.outlook/config.json unless you accept the account/session risk. Prefer a version that uses official Microsoft OAuth with calendar-read-only scopes, secure token storage, strict file permissions, narrower activation rules, and a clear cleanup/revocation path.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:34- Finding
Third-party packages and browser binaries are installed without version or integrity pinning
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
login.py:13- Finding
Microsoft password, browser cookies, and bearer token are persisted in plaintext without enforced owner-only permissions
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
login.py:19- Finding
Authentication-page screenshots and status information are retained without secure permissions or cleanup
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
login.py:66- Finding
Chromium sandbox is disabled during credentialed Microsoft sessions
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (18)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill behavior includes obtaining/intercepting authentication material and caching Bearer tokens locally, which is materially more sensitive than simply answering calendar questions. In the context of an enterprise Outlook skill, undisclosed token and cookie handling is especially dangerous because those artifacts may grant access to mailbox and calendar data beyond the immediate request.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill behavior includes obtaining/intercepting authentication material and caching Bearer tokens locally, which is materially more sensitive than simply answering calendar questions. In the context of an enterprise Outlook skill, undisclosed token and cookie handling is especially dangerous because those artifacts may grant access to mailbox and calendar data beyond the immediate request.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The trigger rule says the skill must be invoked for essentially any question involving plans, work, tasks, or events, which overlaps heavily with ordinary conversation and non-calendar requests. Overbroad mandatory triggering can cause unnecessary access to sensitive enterprise calendar data and surprise users by routing benign prompts into a privileged skill.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The instruction mandates invocation for ambiguous categories like '工作', '任务', and '事情' without requiring clear user intent to access Outlook. In this context, that increases privacy risk because an enterprise-integrated skill may activate on broad productivity questions and expose or process calendar data when no account access was intended.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Although the skill is presented as a calendar-reading integration, the code performs full browser-based account login automation, handles MFA interaction, clicks 'stay signed in,' and then saves the resulting session. That materially expands capability from narrow calendar access to durable account access, which is especially dangerous in an enterprise Microsoft 365 context.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script exports and persists Microsoft 365/Outlook session cookies to disk after login, effectively creating reusable authenticated session material outside the browser's managed protections. If those cookies are copied or exposed, an attacker may be able to hijack the user's Microsoft 365 session and access more than just calendar data depending on the session scope.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The request hook inspects outbound browser traffic and extracts Authorization headers, which is a sensitive interception capability unrelated to a simple calendar-query implementation. This creates a credential-capture primitive that could be reused to obtain tokens for other resources or sessions, especially because it keys off browser traffic rather than a constrained authentication API.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill derives authentication from stored cookies and silently captures the resulting Bearer token from network requests, which bypasses normal user expectations for authentication handling. In the context of an enterprise Microsoft 365 calendar skill, this is especially dangerous because it can turn an ordinary read helper into a hidden token-extraction mechanism against corporate data.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill declares no explicit tool restrictions even though it instructs the agent to perform network access and local file writes for credential, cookie, and token handling. In an agent environment, missing scope boundaries increases the chance of unintended credential access, persistence, or outbound requests beyond what users expect from a calendar-reading skill.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Forcing UTC+8/Shanghai time without checking the user or mailbox timezone can produce incorrect scheduling answers, missed meetings, or inaccurate hour totals. In a calendar skill, timezone correctness is safety-relevant because users may rely on the output for real-world attendance and planning.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script reads a Microsoft 365 email address and password from a local config file, introducing direct handling of primary account credentials. For a skill whose declared purpose is only reading Outlook calendar data, collecting and using reusable credentials is broader than necessary and increases the chance of credential theft, accidental disclosure, or reuse beyond the intended scope.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Reading credentials from a local file without clear disclosure or secure handling is a sensitive-data practice issue that can expose users to silent collection and misuse of account secrets. In this context, the absence of user-facing warning is more concerning because the skill description implies a simple calendar reader, not a password-consuming login helper.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Writing authentication cookies to disk without explicit warning creates persistent sensitive session storage that users may not realize exists. Those files can be stolen by local malware, other users on the system, or backups/log collection, enabling session replay or unauthorized account access.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The script's natural-language descriptions and user-facing messages are written in Chinese, and output formatting also assumes Chinese-language presentation. The file does not offer any language or locale choice, nor does it document a region-specific justification for enforcing this locale.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The code loads and reuses a cached Bearer token from a local file for up to an hour, extending the useful lifetime of a sensitive credential beyond the interactive session. If another local process, user, or backup/logging mechanism can read that file, the token may be replayed to access calendar data or other permitted resources.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill’s stated purpose is narrow read-only calendar retrieval, but the implementation goes beyond that by harvesting a Bearer token from live browser traffic and persisting it for later reuse. A reusable access token can often be used outside the immediate script context to access the user’s Microsoft 365 data, creating credential theft and lateral misuse risk if the file is exposed or the skill is repurposed.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Writing the intercepted Bearer token to disk without explicit disclosure or consent creates a stealth credential-retention risk. Users may believe the skill only reads calendar entries, while in reality it leaves behind a reusable authentication artifact that could be stolen or reused later.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
User-facing strings in the module description and runtime logs are written only in Chinese. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation unless the locale limitation is explicitly justified.
- Content
Static analysis
No suspicious patterns detected.