Outlook

• Outcome: Review
• Latest audit: Jul 10, 2026 · 2:15 AM UTC
• Version: 1.3.0

Overview

This Outlook skill is mostly purpose-aligned, but it gives broad mailbox/calendar control and has unsafe local file and credential-handling behavior that merits Review.

Install only if you are comfortable allowing an agent to read and modify Outlook mail, send email as you, and edit your calendar. Treat ~/.outlook-mcp as sensitive credential storage, avoid printing access tokens, review every send/delete/bulk/calendar-changing action before it runs, and avoid downloading attachments to sensitive paths until path handling is fixed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (19)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill clearly invokes shell scripts for setup, token management, email, and calendar operations, yet no explicit permission model is declared in the manifest. This creates an authorization gap where a consumer may not understand that the skill can execute local commands and handle sensitive OAuth material, increasing the chance of over-trust and unsafe deployment.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The download command retrieves attachment content from Microsoft Graph and writes it to an arbitrary local path provided by the caller. That extends the skill from mailbox management into filesystem modification, which increases risk of unintended local file creation or overwrite if an agent invokes it unsafely.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The script automatically creates an Azure AD application and generates a client secret, which expands from simple Outlook access into tenant/app provisioning and long-lived credential creation. This increases the attack surface because it leaves behind reusable app credentials that can be abused beyond a one-time interactive login if the local machine or config directory is compromised.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The trigger description is broad enough to match common requests about email or scheduling, which can cause the skill to activate in situations where the user did not intend to grant mailbox or calendar access. In a skill that can read, send, delete, and move email, over-broad routing materially increases privacy and integrity risk.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documentation advertises destructive and privacy-impacting capabilities such as deleting, moving, sending mail, and writing calendar events, while also storing OAuth credentials locally, but does not prominently warn users about these risks. In this context, missing warnings can lead users to authorize broad access without understanding that mailbox contents and persistent tokens are exposed to local compromise or accidental modification.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The guide instructs users to place the OAuth client secret directly into a plaintext JSON file on disk. Although it recommends restrictive file permissions, storing long-lived secrets unencrypted still increases the chance of accidental disclosure through backups, dotfile syncing, shell history, screenshots, malware, or local compromise.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The attachment download path silently writes decoded content to disk without any warning, confirmation, or indication that the local filesystem will be modified. In an agent setting, this can surprise users and enable unsafe file placement or persistence of sensitive content.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The send command performs an outbound email action immediately once called, with no confirmation step or safety interlock. In an agent workflow, this can lead to accidental data exfiltration, phishing-style misuse, or mistaken transmission to the wrong recipient.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: Reply, forward, and send-draft are outbound communications that can disclose message content or trigger unwanted actions, yet they execute without an explicit user confirmation checkpoint. This is especially risky because reply/forward act on existing messages and may propagate sensitive information inadvertently.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: Delete and similar destructive mailbox operations execute directly without confirmation, increasing the chance of accidental or agent-induced mailbox modification. Even if deletion moves mail to trash instead of permanent removal, it can still disrupt workflows and hide important messages.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The script writes the OAuth client secret to a local JSON file without prominently warning the user that a reusable confidential credential is being stored on disk. Even with chmod 600, local malware, backups, or other processes running as the same user may obtain the secret and use it to mint or refresh tokens against Microsoft Graph.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script requests broad delegated permissions including Mail.ReadWrite, Mail.Send, Calendars.ReadWrite, and offline_access, but does not clearly explain the scope or persistence of access before the user authorizes it. In the context of an email/calendar skill, these scopes allow reading, modifying, and sending mail plus persistent refresh-based access, which is sensitive and should require explicit, informed consent.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The script's `get` action prints the current OAuth access token directly to stdout, which can be captured by terminal history, shell pipelines, logs, calling processes, or other users observing the session. In an agent/tooling context this is more dangerous because tokens may be surfaced back to the LLM, orchestration logs, or chat output, enabling unauthorized access to the user's Outlook mail and calendar via Microsoft Graph.

External Transmission

Medium

• Category: Data Exfiltration

Content

LOCATION_JSON=",\"location\": {\"displayName\": \"$LOCATION\"}"
        fi
        
        curl -s -X POST "$API/calendar/events" \
            -H "Authorization: Bearer $ACCESS_TOKEN" \
            -H "Content-Type: application/json" \
            -d "{

• Confidence: 95% confidence
• Finding: curl -s -X POST "$API/calendar/events" \ -H "Authorization: Bearer $ACCESS_TOKEN" \ -H "Content-Type: application/json" \ -d

External Transmission

Medium

• Category: Data Exfiltration

Content

END=$(date -d "$START_TIME + 1 hour" +"%Y-%m-%dT%H:%M" 2>/dev/null || echo "$START_TIME")
        fi
        
        curl -s -X POST "$API/calendar/events" \
            -H "Authorization: Bearer $ACCESS_TOKEN" \
            -H "Content-Type: application/json" \
            -d "{

• Confidence: 95% confidence
• Finding: curl -s -X POST "$API/calendar/events" \ -H "Authorization: Bearer $ACCESS_TOKEN" \ -H "Content-Type: application/json" \ -d

External Transmission

Medium

• Category: Data Exfiltration

Content

;;
        esac
        
        curl -s -X PATCH "$API/calendar/events/$FULL_ID" \
            -H "Authorization: Bearer $ACCESS_TOKEN" \
            -H "Content-Type: application/json" \
            -d "$BODY" | jq '{status: "event updated", subject: .subject, start: .start.dateTime[0:16], end: .end.dateTime[0:16], id: .id[-20:]}'

• Confidence: 96% confidence
• Finding: curl -s -X PATCH "$API/calendar/events/$FULL_ID" \ -H "Authorization: Bearer $ACCESS_TOKEN" \ -H "Content-Type: application/json" \ -d

Credential Access

High

• Category: Privilege Escalation

Content

## Files

- `~/.outlook-mcp/config.json` - Client ID and secret
- `~/.outlook-mcp/credentials.json` - OAuth tokens (access + refresh)

## Permissions

• Confidence: 91% confidence
• Finding: credentials.json

Credential Access

High

• Category: Privilege Escalation

Content

CONFIG_DIR="$HOME/.outlook-mcp"
CONFIG_FILE="$CONFIG_DIR/config.json"
CREDS_FILE="$CONFIG_DIR/credentials.json"

APP_NAME="Clawdbot-Outlook"
REDIRECT_URI="http://localhost"

• Confidence: 98% confidence
• Finding: credentials.json

Session Persistence

Medium

• Category: Rogue Agent

Content

The setup script will:
1. Log you into Azure (device code flow)
2. Create an App Registration automatically
3. Configure API permissions (Mail.ReadWrite, Mail.Send, Calendars.ReadWrite)
4. Guide you through authorization
5. Save credentials to `~/.outlook-mcp/`

• Confidence: 86% confidence
• Finding: Create an App Registration automatically 3. Configure API permissions (Mail.ReadWrite, Mail.Send, Calendars.ReadWrite) 4. Guide you through authorization 5. Save credentials to `~/.outlook-mcp/` ## M

VirusTotal

58/58 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.