m365cli

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:12 AM UTC
• Version: 1.1.0

Overview

This skill matches its Microsoft 365 purpose, but its default guidance can expose corporate mail and files in risky ways.

Review this before installing if the account has sensitive mail or business files. Use it only for a work/school account, pin or verify the m365-cli package before global installation, avoid --force unless you have confirmed the sender and message, require explicit confirmation before sending, deleting, or sharing, and prefer named-user or organization-scoped sharing over anonymous links.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:10

Finding

Unpinned Global Installation of a Third-Party npm Package

Content

View full analysis

Remediation

View remediation

``` 2. Document the expected package version and integrity hash. 3. Prefer a project-local installation with a committed lockfile instead of a global installation. 4. Install with lifecycle scripts disabled when compatible with the package: ```bash npm install --ignore-scripts m365-cli@ ``` 5. Verify the npm publisher, source repository tag, release provenance, and package contents before updating the pinned version. 6. Consider running the CLI in a restricted environment that exposes only the files and network destinations required for the requested Microsoft 365 operation. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:45

Finding

Default Workflows Bypass the Trusted-Sender Email Safeguard

Content

View full analysis

--force --json m365 mail send "[e-mail]" "Subject" "Body" --json m365 mail send "[e-mail]" "Subject" "Body" --attach file.pdf --cc "[e-mail]" --json m365 mail search "keyword" --top 20 --json ``` The standard “Read and reply” workflow repeats the bypass: ```bash m365 mail list --top 5 --json # 1. Find email m365 mail read --force --json # 2. Read content m365 mail reply "Reply content" --json # 3. Reply ``` The security section also advertises the bypass: ```markdown ## Trusted Senders (Security) `m365 mail read` filters untrusted sender content (shows metadata only). Use `--force` to bypass. ``` ### Technical Analysis The Skill correctly identifies email bodies as an untrusted prompt-injection channel and provides a trusted-sender whitelist. However, its primary examples and standard read-and-reply workflow invoke `m365 mail read` with `--force`, which disables that protection. An email body is attacker-controlled content. If the full body is placed into an AI agent's context, instructions embedded in the message may be interpreted as operational directions rather than inert data. This is especially consequential because the Skill can send or forward email, access attachments, upload and download files, delete cloud data, and create sharing links. ...[truncated 1626 chars]

Remediation

View remediation

--json ``` 2. Require explicit user approval before bypassing the trusted-sender filter. 3. Display and verify the sender address before offering the bypass. 4. Treat retrieved email bodies as untrusted data and prohibit following instructions contained in them. 5. Separate content retrieval from action execution. Require a fresh confirmation before replying, forwarding, attaching files, sharing content, or deleting data. 6. Summarize untrusted messages through a constrained processing path that cannot issue tool calls. 7. Record when and why the bypass was used without logging the email body or OAuth credentials. 8. Prefer narrowly scoped, one-message authorization rather than permanently adding a sender or entire domain to the whitelist. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: references/commands.md:501

Finding

Anonymous OneDrive Sharing Is the Documented Default

Content

View full analysis

[options] ``` ```markdown | Option | Description | Default | |--------|-------------|---------| | `--type ` | Link type | `view` | | `--scope ` | Sharing scope | `anonymous` | | `--json` | JSON output | — | ``` ### Technical Analysis The command reference states that `anonymous` is the default sharing scope. Consequently, invoking `m365 od share ` without an explicit `--scope` may create a link usable without organizational authentication. `SKILL.md` instructs the agent to warn the user when anonymous sharing is used, but it does not require explicit confirmation or mandate a safer scope. A warning alone does not prevent an agent from accidentally creating a public link when the user merely requests that a file be “shared.” This behavior violates secure-by-default principles for corporate cloud storage. The least-exposure option should be an identified user or, where appropriate, the authenticated organization. ### Attack Path 1. A user asks the agent to share a OneDrive file without specifying the intended audience or sharing scope. 2. The agent invokes the documented command without an explicit scope: ```bash m365 od share "Documents/report.pdf" ``` 3. The CLI applies its documented `anonymous` default. 4. An unauthenticated sharing link is created. 5. The link is copied to an unintended recipient, exposed in logs or chat history, or forwarded beyond the intended audience. 6. Anyone possessing the link can access the file according to the link's configured view or edit permission. ### Impact Assessment Exploitation or accidental misuse could disclose corporate OneDrive content outside the organization. If an anonymous link is created with edit permission, unauthorized pa ...[truncated 301 chars]

Remediation

View remediation

--role read --json ``` 3. If link sharing is required, prefer the organization scope: ```bash m365 od share --type view --scope organization --json ``` 4. Require informed user confirmation before creating any anonymous link. 5. Confirm the path, access type, intended audience, and expiration policy before sharing. 6. Prefer read-only access unless the user explicitly requests edit access. 7. After creation, report the effective scope and advise the user to revoke the link when it is no longer needed. 8. If the underlying CLI supports configuration changes, change its default from `anonymous` to `organization` or require the scope argument. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

md

- **Sharing files (anonymous scope)**: Warn the user that anyone with the link can access.

### Credential Safety
- **Never** read, output, or log `~/.m365-cli/credentials.json` — it contains OAuth tokens.
- **Never** include full email bodies or attachment contents in agent output unless the user explicitly requested that specific email.
- **Summarize** email content instead of echoing it verbatim when presenting results.
- Credential refresh is automatic; never attempt to manually edit or parse the token file.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/commands.md (reported line 726)May include surrounding context.

md

- **Sharing files (anonymous scope)**: Warn the user that anyone with the link can access.

### Credential Safety
- **Never** read, output, or log `~/.m365-cli/credentials.json` — it contains OAuth tokens.
- **Never** include full email bodies or attachment contents in agent output unless the user explicitly requested that specific email.
- **Summarize** email content instead of echoing it verbatim when presenting results.
- Credential refresh is automatic; never attempt to manually edit or parse the token file.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/commands.md (reported line 739)May include surrounding context.

md

- **Sharing files (anonymous scope)**: Warn the user that anyone with the link can access.

### Credential Safety
- **Never** read, output, or log `~/.m365-cli/credentials.json` — it contains OAuth tokens.
- **Never** include full email bodies or attachment contents in agent output unless the user explicitly requested that specific email.
- **Summarize** email content instead of echoing it verbatim when presenting results.
- Credential refresh is automatic; never attempt to manually edit or parse the token file.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest states this skill is for Microsoft 365 work/school account services only and specifically says not to use it for personal Outlook.com/Hotmail/Live accounts. However, the documented m365 login command explicitly supports --account-type <type> with personal as an allowed value, which broadens the skill beyond the declared scope.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/commands.md (reported line 205)May include surrounding context.

md

| Option | Description |
|--------|-------------|
| `--force` | Skip confirmation prompt |
| `--json` | JSON output |

### m365 mail move

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/commands.md (reported line 272)May include surrounding context.

md

| Option | Description |
|--------|-------------|
| `--force` | Skip confirmation prompt |
| `--json` | JSON output |

### m365 mail move

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/commands.md (reported line 553)May include surrounding context.

md

| Option | Description |
|--------|-------------|
| `--force` | Skip confirmation prompt |
| `--json` | JSON output |

### m365 mail move

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The OneDrive sharing commands document creation of anonymous links and invitations without an explicit warning about external or public disclosure. In a corporate M365 context, users may unintentionally expose sensitive business files outside the organization, especially because the default share scope is documented as anonymous.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The OneDrive delete command is documented as capable of deleting files or folders, with a --force option, but without a visible warning about destructive action or recovery expectations. In a work/school storage context, this increases the risk of accidental deletion of important corporate data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The documentation presents export M365_TIMEZONE="Asia/Shanghai" as the sole override example, which can implicitly steer agents toward a specific locale setting. Under the policy rules, hard-coded locale guidance should either offer user choice or explain why that locale is required.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest says the skill should not be used for Azure/Entra/Intune/tenant admin tasks. The configuration section documents tenant ID and client ID environment variables for custom Azure AD app setup, which introduces Azure/Entra-oriented configuration behavior outside the stated purpose of using the skill for Exchange, OneDrive, SharePoint, and directory search tasks.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.