ClawHub
Back to skill

Security audit

office365-connector

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real Office 365 connector, but it needs Review because it requests broad Microsoft account powers and includes raw token access.

Install only if you are comfortable granting this skill read/write access to mail, calendars, contacts, permission to send mail, and long-lived refresh access. Prefer a reduced Azure permission set for the features you actually use, avoid using auth.js token except for controlled debugging, and revoke the Azure app if tokens or ~/.openclaw/auth files may have been exposed.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (7)

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill documentation describes use of environment variables for Azure tenant/client credentials, but there is no declared permission model warning that the skill accesses sensitive local configuration and secrets. This creates a transparency and consent gap: users may grant or run the skill without understanding it reads privileged env data and stores authentication material locally.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The documented behavior materially exceeds and diverges from the advertised connector purpose by managing multiple credential sets, importing legacy auth state, and exposing raw access tokens via a CLI command. Exposing bearer tokens and under-describing credential handling increases the risk of credential theft, privilege misuse, and unsafe automation assumptions, especially when the claimed feature set is incomplete or inaccurate.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The skill advertises destructive capabilities such as deleting messages, modifying calendars, and changing contacts without prominent user-facing safety guidance, confirmation requirements, or discussion of irreversible effects. In an agentic setting, this raises the chance of accidental destructive actions against live Microsoft 365 data.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The CLI `token` command prints the raw OAuth access token directly to stdout, which can leak credentials into terminal scrollback, shell history workflows, CI logs, process captures, or calling tools that record command output. In the context of a Microsoft Graph connector with broad mail/calendar/contact scopes, exposure of this bearer token can enable unauthorized API access until expiry and possibly continued access if paired with automated refresh workflows.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The guide instructs users to grant a broad set of delegated Microsoft Graph permissions covering email, calendar, contacts, send capability, and offline refresh access, but it does not present a consolidated warning about the resulting scope of data access and persistence. In the context of an agent skill, these permissions would let the skill read, modify, and send sensitive user content across multiple data domains, increasing privacy and account-abuse risk if the skill is compromised or misused.

Excessive Permissions

Low
Category
Privilege Escalation
Content
2. You'll see `User.Read` already granted by default
3. Click **+ Add a permission**

**Add each of the following permissions:**

### For Email Support:
1. Click **Microsoft Graph** → **Delegated permissions**
Confidence
88% confidence
Finding
The requested permission bundle is broader than least privilege because it combines read, write, and send access for mail plus read/write access for calendar and contacts, regardless of whether every deployment needs all features. In an agent integration, excessive delegated permissions materially increase blast radius if tokens are stolen, the skill behaves incorrectly, or prompts induce unintended actions.

Session Persistence

Medium
Category
Rogue Agent
Content
### Email Permissions
- `Mail.Read` - Read user email
- `Mail.ReadWrite` - Read and write access to user email
- `Mail.Send` - Send email as the user

### Calendar Permissions
Confidence
72% confidence
Finding
The skill intentionally requests offline access and stores refresh-capable authentication state for persistent access to email, calendar, and contacts. While normal for OAuth integrations, session persistence increases blast radius if token files or the host account are compromised, because an attacker may retain ongoing API access without re-prompting the user.

Static analysis

No suspicious patterns detected.