Security audit

Full access to all Exchange 2010 EWS functions, should work with other EWS Open Source

Security checks across malware telemetry and agentic risk

Overview

This looks like a real Exchange EWS integration, but it gives an agent broad live mailbox authority without enough guardrails.

Install only if you intend to give the agent broad access to a live Exchange mailbox. Use least-privilege credentials, fix the PICARD_PASSWORD versus EXCHANGE_PASSWORD mismatch before use, remove organization-specific defaults, restrict shared mailbox access, require explicit confirmation before sending or deleting/modifying Exchange data, and constrain attachment downloads to a safe cleaned-up directory.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Context-Inappropriate Capability

High

Confidence: 93% confidence
Finding: The module exposes a very broad set of Exchange capabilities including reading mail, sending mail, modifying calendars, managing tasks, processing attachments, and changing out-of-office settings, while no bounded skill purpose or authorization model is defined. In an agent context, this creates an overprivileged integration that can enable bulk access, exfiltration, impersonation-like actions, or destructive changes well beyond a narrowly scoped business need.

Context-Inappropriate Capability

High

Confidence: 95% confidence
Finding: The shared calendar helpers accept an arbitrary email address and attempt delegate access using the configured service credentials, with no restriction on which mailboxes may be queried. In a real deployment, this can enable unauthorized cross-mailbox data access if the service account has broad delegate rights, exposing sensitive schedules, locations, and meeting content.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The attachment-processing feature saves message attachments to local temporary files and extracts their contents, increasing the attack surface for sensitive-data exposure and unsafe file handling. Because the feature processes potentially arbitrary email content without clear necessity, it can facilitate local data residue, unintended disclosure, and handling of untrusted documents.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill documentation explicitly instructs users to configure live Exchange credentials and exposes broad mailbox capabilities including reading email, shared mailbox access, contacts, tasks, and out-of-office settings, but it provides no privacy, authorization, or operational safety warning. In an agent context, this can normalize high-risk access and make unauthorized or overbroad data access more likely, especially for shared mailboxes and enterprise directories.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The documentation describes downloading attachments to a local path and extracting document text without warning that this writes potentially sensitive files to disk and processes confidential content. In an automated agent environment, this increases the risk of inadvertent data leakage, unsafe storage in shared locations such as /tmp, and overexposure of attachment contents through logs or downstream tools.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: This code writes attachment contents to temporary files without any user-facing disclosure, confirmation, or cleanup guarantees. In an agent workflow, users may not realize that email attachments are being persisted locally, which can leave sensitive documents on disk and violate data-handling expectations.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The function deletes calendar events immediately by ID, with no confirmation, dry-run, or policy check. In an agent setting, prompt mistakes, ambiguous references, or malicious instructions could cause irreversible disruption to schedules and business operations.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The task deletion helper performs an immediate destructive action with no confirmation or safety interlock. This makes accidental or malicious deletion of work items easy in an autonomous or semi-autonomous agent environment, potentially causing loss of operational tracking data.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The email-sending function transmits arbitrary caller-provided recipients and content over the network without any explicit approval or disclosure step. In an agent context, this can be abused for unauthorized outbound communication, data exfiltration, or social-engineering messages sent from a trusted mailbox.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The attachment download feature writes email attachment content to a caller-specified path without warning or path safety controls. This can lead to silent local persistence of sensitive files and, depending on the path provided, overwriting or planting files in unintended locations.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.