Outlook Calendar

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:21 AM UTC
• Version: 0.1.1

Overview

The skill is a coherent Outlook Calendar integration, but it relies on an unpinned third-party plugin that receives API-key and calendar-account authority including event changes and deletions.

Review the `openclaw-morphixai` plugin source, publisher, and version before installing. Prefer a pinned or verified release, use a narrowly scoped and revocable MorphixAI API key, and confirm the Microsoft account permissions because the integration can read calendar details and create, update, delete, or invite attendees to events.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:16

Finding

Unpinned Third-Party Plugin Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 16
Vulnerability Type: Supply-chain risk from an unpinned third-party dependency
Risk Level: Medium

Vulnerable Code Snippet:

shell

openclaw plugins install openclaw-morphixai

Technical Analysis

The skill directs users to install the third-party openclaw-morphixai plugin using only a mutable package name. It does not pin a reviewed version or immutable digest, verify a checksum or signature, or identify a trusted source from which the package must be obtained.

Consequently, the code installed when the command is executed may differ from the version originally reviewed. A compromised registry account, malicious package replacement, dependency confusion condition, or unsafe future release could introduce attacker-controlled behavior.

This risk is security-sensitive because the plugin is subsequently entrusted with a MorphixAI API key and access to a linked Microsoft Outlook Calendar account. Its documented capabilities include reading calendar and user information and creating, updating, or deleting events.

Attack Path

1. An attacker compromises the plugin's distribution account or otherwise causes a malicious package or release to resolve under openclaw-morphixai.
2. A user follows the skill documentation and executes the unpinned installation command.
3. The package manager retrieves and installs the attacker-controlled version because no version, digest, signature, or checksum is enforced.
4. The user configures MORPHIXAI_API_KEY and links an Outlook Calendar account as instructed.
5. The compromised plugin accesses the API key or abuses the linked account's granted permissions.
6. Subject to those permissions, the plugin can expose calendar information or perform unauthorized calendar operations.

This path depends on compromise or substitution of the external dependency; the audited file itself does not contain an embedded ...[truncated 772 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the plugin to a specifically reviewed version rather than installing the latest mutable release.
2. Prefer an immutable package digest or commit identifier where the plugin system supports it.
3. Publish the authoritative package registry and source repository locations to reduce package-substitution and dependency-confusion risks.
4. Verify package signatures or cryptographic checksums before installation.
5. Document the expected publisher identity and provide a reproducible verification procedure.
6. Review the plugin and its transitive dependencies before approving upgrades.
7. Document and minimize the OAuth scopes granted to the linked Outlook account.
8. Use a narrowly scoped, revocable API key and rotate it if dependency compromise is suspected.
9. Require explicit user confirmation before destructive operations or actions that send invitations.
10. Monitor plugin releases and maintain a controlled allowlist of approved versions.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The description and all operational instructions are written in Chinese, which implies a fixed language experience for the skill. The file does not indicate that users may choose another language or that the Chinese-only presentation is required for a region-specific or compliance reason.

Content

No source excerpt is available for this finding.