ClawHub
Back to skill

Security audit

MS Teams Meetings

Security checks for vulnerabilities and agentic risk

Overview

This Teams meeting skill matches its stated purpose, but it needs review because its OAuth setup file is missing and first use can install unpinned Python packages while the skill uses calendar and meeting write access.

Install only if you are comfortable granting a Microsoft app registration you control calendar and Teams meeting write access. Ask the publisher to include the missing setup.py or correct the setup instructions, and consider installing reviewed, pinned dependencies yourself before running the scripts.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

os.system() or os exec-family call

High
Category
Dangerous Code Execution
Content
import msal  # noqa: F401
        import requests  # noqa: F401
    except ImportError:
        os.system("python3 -m pip install --user msal requests python-dateutil tzlocal")


def build_msal_app():
Confidence
95% confidence
Finding
The code executes a shell command to install dependencies automatically whenever imports fail. Although the command string is hardcoded and not directly influenced by user input, invoking the shell from a helper routine expands the skill's capabilities unexpectedly, can modify the host environment without consent, and may execute an unintended pip/python binary from PATH.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
This helper silently installs Python packages as a side effect of normal execution, which is not necessary for token handling itself and is broader than users would reasonably expect. In a skill context, hidden package installation is dangerous because it changes the local environment and relies on external package resolution without transparency.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill performs package installation automatically and without any warning, prompt, or consent. Even if intended as convenience, silent environment modification is a security concern because users are not given a chance to review what will be installed or to reject the action.

Missing User Warnings

Medium
Confidence
76% confidence
Finding
The code persists the MSAL token cache to disk, which can contain sensitive access and refresh tokens. The file permissions are tightened to 0600, which reduces exposure, but the local storage of tokens still creates theft risk on compromised or multi-user systems and is not clearly disclosed nearby.

Static analysis

No suspicious patterns detected.