Security audit

WorkIQ

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent Microsoft 365 query purpose, but it asks agents to run sensitive CLI queries through unsafe shell-style command templates and unpinned package execution.

Install only if you trust the WorkIQ package source and are comfortable granting a CLI access to the Microsoft 365 data available to your signed-in account. Prefer a preinstalled, reviewed, version-pinned WorkIQ binary, avoid npx -y runtime execution, and ensure agents pass the question as a separate process argument rather than building a shell command string.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:29
Finding: Potential Shell Command Injection Through User-Controlled Query Text
Content: View full analysis
" ``` **If only `npx` is available (Node.js required):** ```bash npx -y @microsoft/workiq ask -q "" ``` ``` ### Technical Analysis The skill instructs the agent to execute WorkIQ through an `exec` tool and place natural-language query text directly inside a shell command. It does not require argument-array execution, validation, or shell-safe escaping. If the agent constructs the command by replacing the placeholder with user-controlled text, a malicious query containing a closing quotation mark and shell metacharacters could terminate the intended argument and introduce another command. Quoting the placeholder with double quotation marks does not make arbitrary input safe when the command itself is assembled as a string. The instruction on line 47 not to pipe or combine WorkIQ output with other commands discourages normal command composition, but it does not prevent injection inside the query argument. ### Attack Path 1. An attacker submits a Microsoft 365 query containing shell syntax designed to close the `-q` argument. 2. The agent substitutes that text into the documented command template. 3. The `exec` tool passes the resulting command string to a shell. 4. The shell interprets the injected metacharacters as executable syntax. 5. The injected command runs with the operating-system privileges and environment access of the agent process. Successful exploitation depends on the execution tool using a shell and the agent performing direct string interpolation. The skill does not mandate the safer non-shell execution model needed to eliminate this path. ### Impact Assessment An attacker could potentially execute arbitrary local commands ...[truncated 581 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:34
Finding: Unpinned Package Download, Installation, and Execution
Content: View full analysis
" ``` The installation guidance also installs whichever version is current at resolution time: ```bash npm install -g @microsoft/workiq workiq accept-eula ``` The same unpinned installation command is repeated in error handling: ```text `workiq` not found | Prompt the user to install: `npm install -g @microsoft/workiq` ``` ### Technical Analysis The package reference `@microsoft/workiq` has no exact version or integrity constraint. Consequently, different invocations may retrieve different package contents even though the audited skill remains unchanged. The `npx -y` fallback is especially sensitive because it automatically approves package retrieval and immediately executes the resolved package. Installation and execution can run package code, including applicable lifecycle behavior, with the invoking user's privileges. The Microsoft package scope and linked Microsoft documentation provide useful provenance signals, and the audit found no evidence that the named package is malicious. Nevertheless, the instructions create a supply-chain trust boundary that is not reproducible or cryptographically fixed. A compromised registry account, package release, distribution channel, or unexpected future update could introduce code that was not included in this audit. ### Attack Path 1. An attacker compromises the package publication process, registry account, or a future package release. 2. The malicious version becomes the version selected by the unpinned package reference. 3. A user or agent invokes `npx -y @microsoft/workiq ...` or follows the global installation instructions. 4. The package is downloaded wi ...[truncated 1165 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The skill instructs use of npx -y @microsoft/workiq without pinning an exact package version, which means each invocation may fetch whatever version is current on the registry at runtime. If the package is compromised, replaced, or a malicious version is published, the agent could execute unreviewed code in the user's environment; because this skill queries Microsoft 365 data, the context increases sensitivity due to potential access to emails, documents, and chats.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.