Security audit

Exchange2010

Security checks across malware telemetry and agentic risk

Overview

This appears to be a real Exchange integration, but it gives an agent broad live mailbox control without enough safeguards.

Install only if you intentionally want the agent to control the configured Exchange account and any delegated/shared mailboxes it can reach. Use a least-privilege account, secure the credentials file, fix the documented credential variable mismatch, restrict shared mailbox/calendar targets, and require explicit human confirmation before sending mail, deleting or modifying items, setting out-of-office replies, or downloading attachments.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (13)

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: This module exposes a very broad set of Exchange read/write capabilities, including reading mail, sending mail, modifying calendars, deleting items, changing OOF settings, and accessing contacts and tasks, without any visible authorization, scope restriction, or purpose limitation. In an agent skill context, such overbroad capability materially increases the blast radius of prompt injection, misuse, or accidental invocation because a caller can pivot from simple read access to destructive or externally transmitting actions.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The shared calendar functions accept arbitrary email addresses and attempt delegate access to other users' calendars, enabling cross-mailbox data access if the service account has permissions. In an agent setting, this can facilitate unauthorized internal surveillance or data harvesting from other users without contextual justification or access control checks.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: Attachment-processing code writes email attachment contents to local temporary files and returns the temp path, which creates a local data exfiltration and persistence risk for potentially sensitive documents. It also processes untrusted content without cleanup or sandboxing, increasing exposure to downstream parsers and leaving sensitive artifacts on disk.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill requires high-value Exchange credentials and advertises access to mailbox, calendar, contacts, tasks, and shared mailboxes, but it provides no warning about secure credential storage, least-privilege use, or the sensitivity of mailbox contents. In practice, this can lead users to place production credentials in local files and grant broad access without understanding the exposure, increasing risk of credential theft and unauthorized data access.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The feature list documents state-changing operations such as sending email, updating or deleting calendar events, managing tasks, setting out-of-office replies, and accessing shared mailboxes without any caution that these actions can alter user or organizational state. This raises the chance of accidental destructive use, abuse of delegated access, and unintended changes to communications or schedules.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The calendar event creation function performs a remote write immediately and has no confirmation, approval, or policy gate. In an agentic environment, a prompt-injected or mistaken instruction could create unauthorized meetings, spam calendars, or cause operational disruption.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The email-sending function transmits arbitrary content to arbitrary recipients using stored credentials with no confirmation or outbound restrictions. This enables phishing, data exfiltration, impersonation, or accidental disclosure if an agent is manipulated into invoking it.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The delete-calendar-event function permanently deletes remote calendar items based solely on an ID and executes immediately. Without confirmation or authorization checks, an agent or attacker can remove meetings, disrupt schedules, and destroy records with minimal friction.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: Beyond the broad capability issue, this function silently writes attachment data to temp files as part of processing, which is a side effect users may not expect. That can expose sensitive attachment contents on disk and create residual artifacts even when the caller only intended text extraction.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The task deletion function removes user data immediately with no confirmation or guardrails. In an agent context, this makes accidental or malicious task destruction straightforward and can affect user productivity and recordkeeping.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The attachment download function writes email attachments to a caller-specified path with no disclosure, path safety checks, or approval step. This can persist sensitive data locally in unexpected locations and may enable unsafe file placement if untrusted paths are supplied by upstream components.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The calendar update function modifies remote event details directly and silently. An agent operating on ambiguous or adversarial instructions could alter meeting times, locations, or content, causing operational confusion and possible social engineering opportunities.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: Changing out-of-office settings affects external communications and user availability signals, yet this function applies changes immediately without confirmation. Misuse could disrupt business communications, send misleading automated replies, or leak internal information to external audiences.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.