ClawHub
Back to skill

Security audit

Outlook

Security checks for vulnerabilities and agentic risk

Overview

This Outlook skill is a disclosed Maton email integration, but users should treat it as sensitive because it can read and send mailbox data when configured.

Install only if you intend to let an agent use your Maton Outlook connection. Keep MATON_API_KEY scoped to this integration where possible, and require explicit review before sending, deleting, moving, or marking messages because mailbox content and outgoing message details will be transmitted through the Maton/Microsoft gateway.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (7)

Tainted flow: 'req' from os.environ.get (line 18, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
raise SystemExit("MATON_API_KEY is required")
    url = f"{BASE}{path}"
    req = urllib.request.Request(url, headers={"Authorization": f"Bearer {key}"})
    with urllib.request.urlopen(req, timeout=60) as r:
        return json.load(r)
Confidence
90% confidence
Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tainted flow: 'req' from os.environ.get (line 17, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
"Content-Type": "application/json",
        },
    )
    with urllib.request.urlopen(req, timeout=60) as r:
        body = r.read().decode("utf-8", "ignore")
        if body:
            print(body)
Confidence
90% confidence
Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The code is clearly for Outlook/Microsoft mail access through the Maton gateway and uses MATON_API_KEY as described, so the target service/resource is consistent. However, the implemented functionality is materially narrower than the declared description. The code only performs read/search operations: profile lookup, listing recent/unread/inbox messages, fetching one message, and searching messages. It does not draft, send, label, move, summarize, or otherwise manage mail state. Since the declared purpose presents a broad full-management integration, while the actual code is a read-only helper, this is a description-behavior mismatch.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
### Delete message

DELETE /me/messages/{message-id}

---
Confidence
80% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill documents use of environment secrets and outbound network access but does not declare any explicit tool scope or permissions boundary. In an agent platform, missing scope declarations can cause over-broad execution privileges or make security review and runtime policy enforcement ineffective, increasing the chance of unauthorized secret access or network calls to mail APIs.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The send command performs an HTTP POST to a remote Outlook gateway containing subject, body, and recipient information. While the skill's purpose is email delivery, this code path lacks an explicit user-facing warning or confirmation for the immediate transmission of potentially sensitive message data.

Intent-Code Divergence

Low
Confidence
79% confidence
Finding
The parser description says this is a helper for common read-only tasks, which suggests mail-reading operations only. However, the `profile` command calls `/me` to fetch the user's mailbox/account profile, which goes beyond the mail-focused tasks described elsewhere in the manifest and inline help.

Static analysis

No suspicious patterns detected.