ClawHub
Back to skill

Security audit

Outlook

Security checks for vulnerabilities and agentic risk

Overview

This skill is a clearly documented wrapper guide for the olk Outlook/OneDrive CLI and MCP, with sensitive account actions disclosed and guarded by confirmation and read-only controls.

Install only if you intend to let olk access Microsoft mail, calendar, contacts, tasks, or OneDrive. Grant the minimum Microsoft scopes needed, use --dry-run for uncertain changes, and prefer OLK_NO_WRITE=1 or OLK_NO_SEND=1 for unattended agent use.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 504)May include surrounding context.

md
| `--mailbox EMAIL` | `OLK_MAILBOX` | Target another user's mailbox (delegated read; mail/calendar/contacts). Needs the matching `.Shared` scope + Exchange Full Access |
| `--results-only` | `OLK_RESULTS_ONLY` | Unwrap JSON envelope |
| `--select FIELDS` | `OLK_SELECT` | Command-specific field projection; `mail list --json` projects both the Graph request and JSON result |
| `--force` | `OLK_FORCE` | Skip confirmations |
| `--dry-run` | `OLK_DRY_RUN` | Preview without executing |
| `-v, --verbose` | `OLK_VERBOSE` | Verbose output |
| `--color auto\|never\|always` | `OLK_COLOR` | Color mode |

Excessive Permissions

Low
Category
Privilege Escalation
Confidence
70% confidence
Finding

Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.

Content

Scanner excerpt · SKILL.md (reported line 423)May include surrounding context.

md
- **Send As** or **Send on Behalf Of** on the mailbox in Exchange; and
- **Full Access** on the mailbox.

Holding one tells you nothing about the others. Full Access alone grants no right to send, and Send As alone is not enough either: [Microsoft requires Full Access for `/users/{mailbox}/sendMail`](https://learn.microsoft.com/en-us/graph/outlook-send-mail-from-other-user), which is the endpoint `olk` uses so that the sent copy lands by default in the shared mailbox's Sent Items rather than yours. Without all three, `mail send --mailbox` fails. Which one is missing is usually not recoverable from the error — Graph often answers a bare `Access is denied`, and even the more specific `ErrorSendAsDenied` speaks only to the sending delegation — so the failure lists all three for you to check against. Immediate `mail reply` and `mail forward` need the same three grants because they read the original from that mailbox before sending as it — and the message ID must be one listed from that mailbox, since IDs are scoped to the mailbox they came from.

`mail reply --draft --mailbox` does not send. It creates the threaded reply in
the shared mailbox and needs `Mail.ReadWrite.Shared` plus Exchange Full Access,