ClawHub
Back to skill

Security audit

Microsoft 365 MCP Server

Security checks for vulnerabilities and agentic risk

Overview

This Microsoft 365 skill is purpose-aligned but asks for broad tenant-wide application permissions that could let an agent read or change sensitive organization data beyond a single user.

Install only in a controlled tenant or with a tightly scoped Entra app. Review and reduce Graph permissions, avoid tenant-wide application access where delegated or read-only scopes would work, restrict which users the MCP server may target, require operator approval for sending messages or creating data, protect and rotate the client secret, and use a lockfile or pinned dependencies before production use.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:31
Finding

Excessive Tenant-Wide Microsoft Graph Application Permissions

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
package.json:15
Finding

Non-Reproducible Dependency Installation Without a Lockfile

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (14)

Exfiltration Commands

High
Category
Prompt Injection
Confidence
90% confidence
Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · README.md (reported line 32)May include surrounding context.

md
### 💬 Teams
- `m365_teams_chats` - List chats
- `m365_teams_messages` - Read chat messages
- `m365_teams_send` - Send message to chat

### 👥 Users
- `m365_users_list` - List organization users

Missing User Warnings

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The README directs users to grant broad Microsoft Graph application permissions such as Mail.ReadWrite, Files.ReadWrite.All, Chat.ReadWrite.All, and User.Read.All with admin consent, but does not warn that these permissions can provide tenant-wide read/write access. In the context of an MCP server exposing those capabilities to an agent, this materially increases the blast radius for data exfiltration, unauthorized messaging, and mass modification of organizational data.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The setup instructions direct users to grant broad Microsoft Graph application permissions and admin consent, including tenant-wide read/write access to mail, files, chats, tasks, and calendars, without warning about the organization-wide blast radius. Because application permissions operate without individual user consent boundaries, a compromised or misused skill instance could access or modify data across the tenant, making this especially dangerous in an MCP/agent integration.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README advertises tools that can send emails/messages and create calendar events or tasks, but it does not clearly warn that these are external, state-changing operations affecting real Microsoft 365 resources. In an agentic setting, lack of explicit disclosure increases the risk of unintended actions, social engineering, or operator misuse because users may treat the skill as read-only when it is not.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The README instructs users to place a CLIENT_SECRET in a .env file but gives no guidance on secure handling of that credential. This can lead to accidental exposure through source control, logs, screenshots, backups, or insecure host environments, enabling unauthorized access to Microsoft Graph under the app identity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill advertises extensive read/write access to highly sensitive Microsoft 365 data sources including mail, files, chats, calendars, and users, but provides no warning about privacy, confidentiality, or destructive-action risks. In an agent context, exposing these capabilities without clear guardrails increases the chance that users enable powerful operations without understanding that the skill can read organizational data and send or modify content on their behalf.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
82% confidence
Finding

The code reads TENANT_ID, CLIENT_ID, and CLIENT_SECRET directly from environment variables to authenticate against Microsoft services, but does not include any user-facing notice or explanatory comment about credential use beyond a generic environment-loading comment. For a code-file audit under this rule, sensitive credential access should have some visible disclosure unless already clearly documented elsewhere.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

This code performs multiple outbound HTTP requests to Microsoft identity and Graph API endpoints, sending mailbox, calendar, files, tasks, chat, and directory data, but provides no confirmation prompt or user-facing disclosure about these network transmissions. The only visible runtime message announces server startup, which does not warn users that their organizational data will be accessed and sent to external services.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The dependency uses a caret range (^1.0.0), which allows automatic installation of newer compatible releases instead of a single fixed version. This increases supply-chain risk and makes builds non-reproducible, especially important here because this package is an MCP server integrating with Microsoft 365 data and permissions.

Content

Scanner excerpt · package.json (reported line 16)May include surrounding context.

json
"author": "Mahmoud Alkhatib",
  "license": "MIT",
  "dependencies": {
    "@modelcontextprotocol/sdk": "^1.0.0",
    "dotenv": "^16.3.1"
  },
  "devDependencies": {

Unverifiable Dependency: @modelcontextprotocol/sdk has 3 known advisory(ies) (CVE-2026-25536 (@modelcontextprotocol/sdk has cross-client data leak via shared server/transport); CVE-2026-0621 (Anthropic's MCP TypeScript SDK has a ReDoS vulnerability); CVE-2025-66414 (Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protec)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
90% confidence
Finding

The manifest depends on @modelcontextprotocol/sdk without pinning an exact version, while known advisories exist for some releases of that package. Because this project is an MCP server connected to Microsoft 365 services, using an affected SDK version could expose sensitive cross-client data, enable denial of service, or weaken network-origin protections, making the uncertainty materially more dangerous than a generic library issue.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
90% confidence
Finding

The dotenv dependency is specified with a caret range, so different installs may resolve to different package versions over time. While dotenv itself is common and this alone is not an immediate exploit, it still weakens build reproducibility and increases exposure to compromised or vulnerable upstream releases.

Content

Scanner excerpt · package.json (reported line 17)May include surrounding context.

json
"license": "MIT",
  "dependencies": {
    "@modelcontextprotocol/sdk": "^1.0.0",
    "dotenv": "^16.3.1"
  },
  "devDependencies": {
    "@types/node": "^20.10.0",

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 20)May include surrounding context.

json
"dotenv": "^16.3.1"
  },
  "devDependencies": {
    "@types/node": "^20.10.0",
    "tsx": "^4.7.0",
    "typescript": "^5.3.0"
  }

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 21)May include surrounding context.

json
},
  "devDependencies": {
    "@types/node": "^20.10.0",
    "tsx": "^4.7.0",
    "typescript": "^5.3.0"
  }
}

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 22)May include surrounding context.

json
"devDependencies": {
    "@types/node": "^20.10.0",
    "tsx": "^4.7.0",
    "typescript": "^5.3.0"
  }
}

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
src/index.ts:14