ClawHub
Back to skill

Security audit

MS Teams Meetings

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly does what it says, but it automatically installs unpinned Python packages while also handling Microsoft calendar-write access and OAuth tokens.

Review this before installing. It will require Microsoft delegated calendar permissions and will store OAuth tokens locally. Install the Python dependencies yourself in an isolated environment with pinned versions, and consider reducing Microsoft Graph scopes to the minimum needed before use. Treat --hard-delete as a permanent calendar deletion action.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
scripts/_common.py:23
Finding

Automatic Installation of Unpinned Third-Party Dependencies

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/_common.py:11
Finding

OAuth Token Requests Permissions Beyond Implemented Functionality

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

os.system() or os exec-family call

High
Category
Dangerous Code Execution
Confidence
93% confidence
Finding

The code executes a shell command to install packages automatically when imports fail. Even though the command string is constant, invoking pip from application logic can trigger unreviewed code execution from package installation hooks, alter the local environment, and perform networked changes without user consent.

Content

Scanner excerpt · scripts/_common.py (reported line 31)May include surrounding context.

python
import msal  # noqa: F401
        import requests  # noqa: F401
    except ImportError:
        os.system("python3 -m pip install --user msal requests python-dateutil tzlocal")


def build_msal_app():

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.

md
Skill: ms-teams-meetings

Overview
- Use this skill to create and manage Microsoft Teams meetings via Microsoft Graph API.
- Capabilities:
  - Create Teams online meetings and send calendar invites
  - List upcoming Teams meetings

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

A common support module should not silently gain the capability to modify the host by installing software at runtime. In this context, the file also handles Microsoft auth tokens, so unexpected package installation expands trust boundaries and makes compromise of the local Python/package environment more dangerous.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The helper runs a shell-based package installation automatically and without any warning or confirmation. Silent environment changes are risky because they hide network access and code installation from the user, and can be abused through dependency confusion, compromised indexes, or malicious package lifecycle scripts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This code performs a destructive calendar deletion when the --hard-delete flag is used, but it provides no confirmation prompt and no explicit warning that the action is irreversible beyond the flag name itself. For a safety-critical delete operation, the file should include a clearer disclosure or confirmation before removing the event.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.