ClawHub
Back to skill

Security audit

Outlook

Security checks for vulnerabilities and agentic risk

Overview

This Outlook skill is a disclosed Maton email integration, but users should treat it as sensitive because it can read and send mailbox data when configured.

Install only if you intend to let an agent use your Maton Outlook connection. Keep MATON_API_KEY scoped to this integration where possible, and require explicit review before sending, deleting, moving, or marking messages because mailbox content and outgoing message details will be transmitted through the Maton/Microsoft gateway.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (7)

Tainted flow: 'req' from os.environ.get (line 18, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/outlook_mail.py (reported line 19)May include surrounding context.

python
raise SystemExit("MATON_API_KEY is required")
    url = f"{BASE}{path}"
    req = urllib.request.Request(url, headers={"Authorization": f"Bearer {key}"})
    with urllib.request.urlopen(req, timeout=60) as r:
        return json.load(r)

Tainted flow: 'req' from os.environ.get (line 17, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/outlook_send.py (reported line 26)May include surrounding context.

python
"Content-Type": "application/json",
        },
    )
    with urllib.request.urlopen(req, timeout=60) as r:
        body = r.read().decode("utf-8", "ignore")
        if body:
            print(body)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The code is clearly for Outlook/Microsoft mail access through the Maton gateway and uses MATON_API_KEY as described, so the target service/resource is consistent. However, the implemented functionality is materially narrower than the declared description. The code only performs read/search operations: profile lookup, listing recent/unread/inbox messages, fetching one message, and searching messages. It does not draft, send, label, move, summarize, or otherwise manage mail state. Since the declared purpose presents a broad full-management integration, while the actual code is a read-only helper, this is a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/graph-examples.md (reported line 130)May include surrounding context.

md
### Delete message

DELETE /me/messages/{message-id}

---

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill documents use of environment secrets and outbound network access but does not declare any explicit tool scope or permissions boundary. In an agent platform, missing scope declarations can cause over-broad execution privileges or make security review and runtime policy enforcement ineffective, increasing the chance of unauthorized secret access or network calls to mail APIs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The send command performs an HTTP POST to a remote Outlook gateway containing subject, body, and recipient information. While the skill's purpose is email delivery, this code path lacks an explicit user-facing warning or confirmation for the immediate transmission of potentially sensitive message data.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

The parser description says this is a helper for common read-only tasks, which suggests mail-reading operations only. However, the profile command calls /me to fetch the user's mailbox/account profile, which goes beyond the mail-focused tasks described elsewhere in the manifest and inline help.

Content

No source excerpt is available for this finding.