Outlook Mcp

• Outcome: Review
• Latest audit: Jul 19, 2026 · 1:56 AM UTC
• Version: 1.12.0

Overview

This Outlook integration is mostly purpose-aligned, but it needs Review because it combines broad mailbox control with under-scoped local file access and persistent token storage risks.

Install only if you are comfortable giving an agent access to sensitive Outlook data and potentially allowing it to send, delete, move, or modify mailbox, calendar, contact, and task data. Start with read_only: true, enable only needed allow_categories/toolsets, avoid exposing attachment tools unless you trust the agent with local file paths, and on Linux configure encrypted keyring support before authenticating.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill exposes significant capabilities including shell execution for installation, network access to Microsoft services, and host file read/write via attachment features, but the manifest does not declare permissions or present a capability boundary. In an agent setting, this reduces transparency and can lead users or orchestrators to grant more trust than warranted, especially because the skill can touch both local files and remote mailbox data.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The documented purpose understates or omits risky host-side behaviors: attachment tools can read arbitrary local files for upload and write downloaded data to arbitrary paths, which materially expands the trust boundary from Outlook-only operations to general filesystem access. The 'zero telemetry' claim is also unsafe if tracing instrumentation exists, because users may rely on that statement when handling sensitive mailbox contents.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The skill advertises destructive and privacy-sensitive operations such as send, delete, move, download, and attachment upload without an explicit high-visibility warning about mailbox modification, exfiltration risk, and local filesystem access. In an agent context, this increases the chance of unsafe autonomous use or accidental approval of dangerous actions.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The plan explicitly enables a debug proxy, captures outbound request bodies, and decompresses stored blobs while querying Outlook-related tool traffic. Because those payloads can include mailbox content, contact data, prompts, and auth-adjacent metadata, omitting any warning, minimization, or sanitization guidance creates a real privacy and data-exposure risk for whoever follows the plan.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: download_attachment writes arbitrary attachment bytes to a caller-supplied path on the local filesystem. The only validation is rejecting '..', which does not prevent absolute paths, symlink targets, sensitive directories, or overwriting existing files, so an agent or prompt-influenced caller could cause unintended local file writes.

Session Persistence

Medium

• Category: Rogue Agent

Content

prompt_callback=None,
        auth_record: AuthenticationRecord | None = None,
    ) -> DeviceCodeCredential:
        """Create a DeviceCodeCredential with persistent cache."""
        global _warned_unencrypted_fallback
        cache_options = TokenCachePersistenceOptions(
            name=CACHE_NAME,

• Confidence: 95% confidence
• Finding: Create a DeviceCodeCredential with persistent cache.""" global _warned_unencrypted_fallback cache_options = TokenCachePersistenceOptions( name=CACHE_NAME, allow

Known Vulnerable Dependency: mcp — 9 advisory(ies): CVE-2025-53366 (MCP Python SDK vulnerability in the FastMCP Server causes validation error, lead); CVE-2025-66416 (Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection); CVE-2026-52870 (MCP Python SDK: Experimental task handlers allow any client to access and cancel) +6 more

High

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: mcp

Known Vulnerable Dependency: azure-identity — 2 advisory(ies): CVE-2024-35255 (Azure Identity Libraries and Microsoft Authentication Library Elevation of Privi); CVE-2024-35255 (Azure Identity Libraries and Microsoft Authentication Library Elevation of Privi)

Medium

• Category: Supply Chain
• Confidence: 84% confidence
• Finding: azure-identity

Known Vulnerable Dependency: pydantic — 4 advisory(ies): CVE-2021-29510 (Use of "infinity" as an input to datetime and date fields causes infinite loop i); CVE-2024-3772 (Pydantic regular expression denial of service); CVE-2021-29510 (Pydantic is a data validation and settings management using Python type hinting.) +1 more

High

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: pydantic

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution, suspicious.obfuscated_code

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/test_preflight.py:21

Potential obfuscated payload detected.

Warn

• Code: suspicious.obfuscated_code
• Location: tests/test_mail_attachments.py:128