Security audit

ExchangeService

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to do its stated Exchange mailbox and calendar job, but it warrants Review because it handles high-value credentials and mailbox data with unsafe transport and setup options.

Install only if you are comfortable granting the configured Exchange account permission to read, send, modify, and delete mailbox, folder, and calendar data. Use a dedicated least-privilege account, require an https:// Exchange URL, avoid --insecure and EXCHANGE_INSECURE, do not put the password or master key directly on command lines, and review or update the NTLM dependency chain before production use.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/node/lib/ews-client.mjs:20
Finding: Exchange Credentials Can Be Transmitted over Insecure or Unauthenticated Connections
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/node/core/setup-exchange-config.mjs:13
Finding: Documented Setup Procedure Exposes the Exchange Password and Master Key in Process Arguments
Content: View full analysis
" \ --master-key "" ``` ```js // scripts/node/core/setup-exchange-config.mjs:13-19 ' --exchange-url https://mail.example.com/EWS/Exchange.asmx \\', ' --username DOMAIN\\\\user \\', '[--domain DOMAIN] \\', ' --auth-mode ntlm \\', ' --password \\', ' --master-key \\', ' [--config-path config/exchange.config.json]', ``` ```js // scripts/node/core/setup-exchange-config.mjs:34-35 const password = args.password || process.env.EXCHANGE_PASSWORD; const masterKey = args.masterKey || process.env.EXCHANGE_SKILL_MASTER_KEY; ``` ### Technical Analysis The primary Quick Start and command usage instructions encourage users to pass both the Exchange password and the encryption master key as command-line arguments. Process arguments can be exposed through operating-system process inspection, shell history, terminal recording, CI/CD logs, job metadata, endpoint telemetry, debugging tools, and monitoring agents. The master key protects the encrypted password stored in `exchange.config.json`. Exposing both the password and the master key in the same command weakens the purpose of encrypted local storage: an observer can either authenticate directly with the password or use the master key to decrypt the stored secret. Although environment-variable fallbacks are implemented, the documented default remains command-line input. Environment variables also require careful handling, but they are generally less likely than command arguments to be retained in ordinary shell history. ### Attack Path ...[truncated 1252 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (18)

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · README.md (reported line 1)May include surrounding context.
md
--- name: exchangeservice description: Cross-platform (Linux/macOS/Windows) skill for Exchange Server 2016 CU21 EWS operations on OpenClaw Node.js runtime. metadata: {"openclaw":{"emoji":"✉️","requires":{"env":["EXCHANGE_URL","EXCHANGE_USERNAME","EXCHANGE_AUTH_MODE","EXCHANGE_PASSWORD","EXCHANGE_SKILL_MASTER_KEY"],"bins":["node","npm"]},"primaryEnv":"EXCHANGE_PASSWORD"}}

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 1)May include surrounding context.
md
--- name: exchangeservice description: Cross-platform (Linux/macOS/Windows) skill for Exchange Server 2016 CU21 EWS operations on OpenClaw Node.js runtime. metadata: {"openclaw":{"emoji":"✉️","requires":{"env":["EXCHANGE_URL","EXCHANGE_USERNAME","EXCHANGE_AUTH_MODE","EXCHANGE_PASSWORD","EXCHANGE_SKILL_MASTER_KEY"],"bins":["node","npm"]},"primaryEnv":"EXCHANGE_PASSWORD"}}

Known Vulnerable Dependency: underscore==1.12.1 — 1 advisory(ies): CVE-2026-27601 (Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS)

High

Category: Supply Chain
Confidence: 95% confidence
Finding: The lockfile pins underscore to 1.12.1, which the supplied advisory identifies as vulnerable to unlimited recursion in _.flatten and _.isEqual, enabling potential denial of service through stack exhaustion or excessive processing. Although this is a transitive dependency pulled in by httpntlm rather than obviously attacker-chosen code, skills that process untrusted mail/calendar data can still be exposed if vulnerable utility functions are reachable in request or response handling.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The package description at L06 presents the skill generically as an "Exchange on-prem skill runtime," which does not disclose that it performs extensive state-changing operations such as creating meetings, sending mail, creating/updating/deleting folders, moving/copying/deleting items, replying, archiving, and marking mail read. The code-facing entry points in L08-L29 show a much broader and more sensitive operational scope than the description communicates.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This code performs a network request to Exchange containing mailbox selection and calendar query parameters, and receives potentially sensitive calendar contents. The script has no confirmation prompt, user-facing log message, or inline comment/docstring warning that it is contacting a remote server and retrieving calendar data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This code reads a master key and password from environment variables and then uses them for authentication, which is a sensitive credential-handling operation. The file contains no confirmation prompt, user-facing notice, or explanatory comment/docstring warning that credentials may be sourced from process environment variables.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The script performs a live authentication request using supplied credentials and allows the TLS validation behavior to be weakened through the insecure option. In a login-verification context this is expected functionality, but if insecure is enabled it can expose credentials to man-in-the-middle interception or allow communication with an untrusted endpoint, making the context materially more dangerous.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The code explicitly supports disabling TLS certificate verification by creating an undici Agent with rejectUnauthorized: false and by passing rejectUnauthorized: !insecure into NTLM requests. This enables man-in-the-middle attacks against EWS authentication traffic, which is especially risky here because the module handles Basic and NTLM credentials and SOAP data sent to a mail server.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: TLS validation can be disabled without any built-in warning, audit signal, or friction, making it easy for callers to unknowingly send Exchange credentials over a connection vulnerable to interception. In this skill context, the danger is elevated because the client is designed to authenticate to EWS using Basic or NTLM, so successful interception could expose mailbox access or session material.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This code assembles sensitive mailbox data into an output object and writes it directly to stdout. For code files, access to potentially sensitive user data should have some visible disclosure such as a prompt, warning, or explanatory comment/docstring, and none appears in this file.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The script performs multiple EWS network calls (FindFolder, FindItem, GetFolder, GetItem) against a mailbox service, including requests that can retrieve message content and recipient data. In this file, there is no visible warning, prompt, or explanatory comment informing the user that mailbox data will be sent to and retrieved from a remote Exchange service.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script can retrieve message bodies and recipient lists via GetItem when includeBody/includeRecipients are enabled, then prints the resulting mailbox contents as JSON. There is no confirmation prompt, visible warning, or explanatory comment/docstring in this file to disclose that sensitive email content and addressing metadata may be accessed and output.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 89% confidence
Finding: The dependency uses a caret range (^1.8.13), allowing future 1.x releases of httpntlm to be installed implicitly. In a security-sensitive skill that authenticates to on-prem Exchange via NTLM, drifting to an unreviewed dependency version increases supply-chain risk and can introduce vulnerable or malicious code into authentication flows.
Content: Scanner excerpt · package.json (reported line 32)May include surrounding context.
json
"mark-all-read": "node ./scripts/node/mailbox-items/mark-all-read.mjs" }, "dependencies": { "httpntlm": "^1.8.13" } }

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The script reads mailbox selection from EXCHANGE_MAILBOX and then sends a GetFolder request to Exchange, which is a network operation involving user or system mailbox data. Within this file there is no confirmation prompt, comment, or user-facing notice describing that mailbox context may be taken from environment variables and transmitted to the Exchange service.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The saveConfig function creates directories and writes a configuration file to disk, which is a safety-relevant file modification. In this file there is no confirmation prompt, user-facing log/print, or explanatory comment/docstring disclosing that the function will persist configuration data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: The readPassword function accesses sensitive authentication material by returning either a provided password, a decrypted secret_store value, or a plaintext password from config. This file contains no user-facing warning, log, or explanatory comment/docstring indicating that credential material will be read and decrypted.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 72% confidence
Finding: The normalization logic explicitly bakes in specific language conventions for reply prefixes (答复, 回复, 转发) in addition to English ones. This imposes language-specific behavior without any user opt-in or documented locale rationale, which can be a natural-language locale policy concern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The function performs an EWS FindItem request against the user's sent-items folder, which accesses mailbox metadata and transmits request data over the network. In this file there is no confirmation prompt, logging, or comment/docstring disclosing that mailbox contents will be queried.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.