Outlook Email

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:22 AM UTC
• Version: 0.1.1

Overview

The skill matches its Outlook email purpose, but it should be reviewed because it relies on an unpinned external plugin and grants sensitive mailbox read/send access without much scoping or safety guidance.

Install only if you trust the MorphixAI plugin source and are comfortable granting it access to your Outlook mailbox. Pin or verify the plugin release where possible, use the least-privileged Outlook connection available, review recipients and content before any send or reply action, and know how to revoke the Outlook connection and rotate the API key.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15

Finding

Unpinned External Plugin with Sensitive Mailbox Access

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 15
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Vulnerable Code Snippet:

text

openclaw plugins install openclaw-morphixai

Technical Analysis

The documented installation command retrieves openclaw-morphixai without specifying an immutable version or integrity digest. The dependency is external to the audited project, so its implementation and future releases cannot be verified from the repository.

The plugin is subsequently intended to receive a MorphixAI API key and operate through a linked Microsoft Outlook account. Its documented capabilities include reading, searching, sending, and replying to email. If the package source, publisher account, distribution channel, or a future unpinned release were compromised, malicious plugin code could execute in the user's environment and abuse the delegated mailbox access.

Attack Path

1. An attacker compromises the plugin publisher, package registry entry, distribution channel, or an unpinned future plugin release.
2. A user follows the documented command, which resolves and installs the attacker-controlled release.
3. The user configures MORPHIXAI_API_KEY and links a Microsoft Outlook account as instructed.
4. The compromised plugin accesses credentials or invokes delegated Outlook operations.
5. The attacker exfiltrates accessible mailbox information, sends unauthorized messages, or performs other operations permitted by the granted scopes.

Impact Assessment

Successful exploitation could expose email content, metadata, contacts referenced in messages, and the MorphixAI API credential available to the plugin process. It could also allow unauthorized email transmission and user impersonation within the permissions granted to the connected Outlook account.

The precise scope depends on the Microsoft Graph permissions granted during account linking and the pr ...[truncated 226 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the plugin to a specific, reviewed version rather than resolving the latest available release.
2. Verify the package through an integrity hash, signature, lockfile, or other immutable provenance mechanism supported by the plugin manager.
3. Document the authoritative package registry, publisher identity, source repository, and release verification process.
4. Review every pinned release before upgrading, with particular attention to credential access, network destinations, and Outlook operations.
5. Request only the minimum Microsoft Graph scopes required for the documented features.
6. Document how OAuth tokens, API keys, email content, and metadata are stored, transmitted, retained, and deleted by the external service.
7. Run the plugin with restricted filesystem, environment-variable, and network access where platform controls permit.
8. Provide procedures for revoking the Outlook connection and rotating the MorphixAI API key after suspected compromise.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly documents actions to send and reply to emails but provides no warning that these operations can transmit data externally, contact unintended recipients, or trigger irreversible business actions. In an agent context, lacking user-facing confirmation guidance increases the risk of accidental data exfiltration, phishing amplification, or unauthorized outbound communication.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The skill description and instructions are presented entirely in Chinese, which can amount to a forced language choice if the organization expects language neutrality or user opt-in. The file does not indicate that the skill is region-specific or provide an alternative language option.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The setup instructions tell users to place an API key in an environment variable but do not mention secure storage, shell history exposure, least-privilege handling, or avoiding disclosure in logs and screenshots. While environment variables are common, undocumented credential-handling precautions can lead to accidental leakage of a token that grants access to Outlook operations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.