outlookcli

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:09 AM UTC
• Version: 1.1.0

Overview

The skill has a coherent Microsoft account management purpose, but its default examples bypass email safety checks and enable broad account-changing actions that need review before installation.

Review this skill carefully before installing. Use a pinned or isolated m365-cli version where possible, do not let an agent bypass the trusted-sender filter unless you explicitly approve that email, require confirmation before sending, forwarding, deleting, uploading, or sharing, and avoid anonymous OneDrive links unless you intentionally want anyone with the link to have access.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:9

Finding

Unpinned Global Installation of a Security-Sensitive Third-Party CLI

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:9
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

Code Snippet:

yaml

install: npm install -g m365-cli

Technical Analysis

The Skill instructs users or agents to globally install m365-cli without specifying an exact reviewed version or package integrity value. Consequently, installation resolves to whichever release is current in the npm registry at execution time.

This CLI is particularly security-sensitive because it receives OAuth authorization to read and modify personal email, calendars, contacts, and OneDrive files. It also stores and uses refreshable credentials. A malicious future release, compromised publisher account, registry compromise, or malicious lifecycle script could execute locally during installation or later command invocation.

The documented GitHub repository, npm package, and publisher provide provenance information but do not make the mutable installation reproducible or protect against a future supply-chain compromise.

Attack Path

1. An attacker compromises the npm publisher account, release process, or package source.
2. The attacker publishes a malicious version under the legitimate m365-cli package name.
3. A user or agent follows the Skill and executes npm install -g m365-cli.
4. npm installs the compromised release globally and may execute its lifecycle scripts.
5. The malicious package accesses local data or intercepts OAuth credentials and Microsoft Graph operations when the user authenticates or invokes the CLI.
6. Stolen credentials or delegated access are used to access the victim's Microsoft account data.

Impact Assessment

Successful exploitation could execute code with the privileges of the user running npm. Because the installed CLI is trusted with broad Microsoft Graph scopes, compromise could expose or modify email, calendar events, contacts, an ...[truncated 199 chars]

Remediation

View remediation

Remediation Suggestions

• Pin m365-cli to an exact version that has been reviewed, rather than resolving the latest release.
• Record and verify package integrity using a lockfile, npm integrity metadata, or a trusted package hash.
• Prefer a project-local installation or isolated execution environment over global installation.
• Disable lifecycle scripts during installation where compatible with the package and workflow.
• Document the reviewed package version, source commit, publisher identity, and expected integrity value.
• Periodically audit dependency ownership and release changes before updating the pinned version.
• Run the CLI under a minimally privileged OS account and limit OAuth scopes to those required for the specific requested operation.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:58

Finding

Default Workflow Bypasses Protection Against Untrusted Email Content

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:58
Vulnerability Type: Unsafe processing of attacker-controlled email content
Risk Level: High

Code Snippet:

bash

# Read / send / search
m365 mail read <id> --force --json
m365 mail send "[e-mail]" "Subject" "Body" --json
m365 mail send "[e-mail]" "Subject" "Body" --attach file.pdf --cc "[e-mail]" --json
m365 mail search "keyword" --top 20 --json

Technical Analysis

The documented primary email-reading workflow uses --force. According to the same Skill and command reference, this option bypasses the trusted-sender whitelist and returns the full content of an untrusted message.

Email bodies are attacker-controlled input. When this Skill is operated by an AI agent, hostile text in an email may contain prompt-injection instructions designed to be interpreted as agent directives rather than message data. Bypassing the available content filter by default increases the probability that untrusted instructions enter the model context.

The danger is amplified by the Skill's ability to send, reply to, forward, move, and delete email; modify calendar data; and upload, download, share, or delete OneDrive content. The security guidance at SKILL.md:189-192 describes the filter, but the operational examples at SKILL.md:58 and SKILL.md:143 normalize bypassing it.

Attack Path

1. An attacker sends an email to the victim containing instructions crafted to manipulate an AI agent.
2. The user asks the agent to inspect or respond to the message.
3. The agent follows the documented workflow and executes m365 mail read <id> --force --json.
4. The trusted-sender filter is bypassed, and the attacker's complete message enters the agent's context.
5. The message directs the agent to disclose data or perform operations such as forwarding messages, sending files, creating anonymous links, deleting content, or contacting an attac ...[truncated 637 chars]

Remediation

View remediation

Remediation Suggestions

• Remove --force from default email-reading and reply workflow examples.
• Use metadata-only output for untrusted senders unless the user explicitly approves reading the message body.
• Require a separate, informed confirmation before bypassing the trusted-sender filter.
• Treat all email subjects, bodies, links, and attachments as untrusted data, never as agent instructions.
• Add explicit guidance that the agent must ignore requests embedded in messages to invoke tools, disclose information, alter security settings, or contact third parties.
• Require user confirmation before sending, forwarding, deleting, sharing, uploading, or changing permissions based on email content.
• Keep trusted-sender entries narrowly scoped to individual verified addresses rather than entire domains where possible.
• Sanitize or isolate message content before placing it in the agent's instruction context.

T09 · Insecure Skill Coding Practices

Warning

• Location: references/commands.md:496

Finding

OneDrive Sharing Command Defaults to Anonymous Access

Content

View full analysis

Vulnerability Details

File Location: references/commands.md:496-503
Vulnerability Type: Insecure sharing default
Risk Level: Medium

Code Snippet:

markdown

### m365 od share

Create a sharing link.

m365 od share <path> [options]

text

| Option | Description | Default |
|--------|-------------|---------|
| `--type <view|edit>` | Link type | `view` |
| `--scope <organization|anonymous|users>` | Sharing scope | `anonymous` |
| `--json` | JSON output | — |

Technical Analysis

The command reference documents that m365 od share defaults to an anonymous sharing scope when the caller does not provide --scope. Anonymous links generally authorize anyone possessing the link rather than a specifically authenticated recipient.

This behavior is especially risky in an agent-driven workflow because a generated command may omit an optional argument. A syntactically valid invocation can therefore create broader access than the user intended. The default conflicts with least-privilege principles for personal OneDrive files, which may contain financial, identity, business, or other sensitive information.

Attack Path

1. A user asks the agent to share a OneDrive file without specifying an access scope.
2. The agent invokes m365 od share <path> and omits --scope.
3. The CLI applies its documented default and creates an anonymous sharing link.
4. The link is copied into an email, chat, log, transcript, or other location.
5. An unintended recipient obtains the link through forwarding, logging, account compromise, or accidental disclosure.
6. The unintended recipient accesses the file without being an explicitly authorized Microsoft account.

Impact Assessment

This can expose the selected OneDrive file or folder to any party that obtains the generated link. The direct scope is limited to the shared object and the permissions represented by the link, ...[truncated 159 chars]

Remediation

View remediation

Remediation Suggestions

• Require callers to specify --scope explicitly rather than relying on the CLI default.
• Recommend --scope users as the standard choice for personal files.
• Require explicit user confirmation before creating an anonymous or editable sharing link.
• Display the chosen scope, permission type, target path, and intended recipients before execution.
• Prefer m365 od invite for recipient-specific access where possible.
• Add a warning immediately beside the command syntax explaining that omission of --scope creates an anonymous link.
• Review and revoke stale anonymous links after the requested sharing task is complete.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 209)May include surrounding context.

md

This skill accesses personal email, calendar, files, and contacts — all sensitive PII.

- **Never** read, output, or log `~/.m365-cli/credentials.json` — it contains OAuth tokens.
- **Never** include full email bodies or attachment contents in agent output unless the user explicitly requested that specific email.
- **Summarize** email content instead of echoing it verbatim when presenting results to the user.
- **Credential refresh** is automatic; never attempt to manually edit or parse the token file.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/commands.md (reported line 583)May include surrounding context.

md

This skill accesses personal email, calendar, files, and contacts — all sensitive PII.

- **Never** read, output, or log `~/.m365-cli/credentials.json` — it contains OAuth tokens.
- **Never** include full email bodies or attachment contents in agent output unless the user explicitly requested that specific email.
- **Summarize** email content instead of echoing it verbatim when presenting results to the user.
- **Credential refresh** is automatic; never attempt to manually edit or parse the token file.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/commands.md (reported line 596)May include surrounding context.

md

This skill accesses personal email, calendar, files, and contacts — all sensitive PII.

- **Never** read, output, or log `~/.m365-cli/credentials.json` — it contains OAuth tokens.
- **Never** include full email bodies or attachment contents in agent output unless the user explicitly requested that specific email.
- **Summarize** email content instead of echoing it verbatim when presenting results to the user.
- **Credential refresh** is automatic; never attempt to manually edit or parse the token file.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill is explicitly described as personal-account-only, yet the command reference documents organization-scoped sharing for OneDrive. This mismatch can cause an agent to attempt enterprise-style sharing behavior or make unsafe assumptions about permitted sharing models, increasing the risk of unintended data exposure; the same section also normalizes highly permissive sharing behavior in a personal data-management context.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.

md

# Folder management
m365 mail folder list --json
m365 mail folder list --parent inbox --json      # List child folders
m365 mail folder create "My Projects" --json
m365 mail folder create "Sub" --parent inbox --json
m365 mail folder delete <folder-id> --force --json

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/commands.md (reported line 199)May include surrounding context.

md

| Option | Description |
|--------|-------------|
| `--force` | Skip confirmation prompt |
| `--json` | JSON output |

### m365 mail move

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/commands.md (reported line 266)May include surrounding context.

md

| Option | Description |
|--------|-------------|
| `--force` | Skip confirmation prompt |
| `--json` | JSON output |

### m365 mail move

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/commands.md (reported line 547)May include surrounding context.

md

| Option | Description |
|--------|-------------|
| `--force` | Skip confirmation prompt |
| `--json` | JSON output |

### m365 mail move

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file documents m365 mail folder delete as deleting a mail folder and all its contents, but it does not include a clear user-facing warning about the impact of removing the folder contents. Under the markdown criteria, behaviours affecting user data should be explicitly warned about, and the mere presence of a --force option does not substitute for that warning.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The OneDrive share command documents anonymous as the default scope without a privacy warning, meaning an agent could generate publicly accessible links unless it overrides the default. In a personal email/OneDrive skill handling sensitive user content, permissive-by-default sharing materially raises the risk of accidental data disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The m365 od rm command deletes files or folders, which can materially affect user data and system state, yet the documentation gives no clear warning aside from noting --force skips confirmation. Markdown documentation for destructive operations should visibly disclose the risk of data loss.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The manifest says this skill is for personal Microsoft accounts only and explicitly excludes work/school accounts. However, the documented configuration exposes M365_TENANT_ID and M365_CLIENT_ID for custom Azure AD app registration, which is a capability associated with broader Microsoft 365/Azure tenant configuration rather than ordinary personal-account task execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The m365 cal delete command removes calendar events, which directly affects user data, but the markdown provides no cautionary note or warning about this destructive behavior. For markdown skill documentation, actions that can change or remove user data should be accompanied by a visible warning.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.