ClawHub
Back to skill

Security audit

m365-mcp

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Microsoft 365 connector that can access and change real account data, so it should be installed only with deliberate account and permission choices.

Before installing, confirm you are comfortable giving an MCP client delegated access to Microsoft 365 data. Use the narrowest Azure delegated permissions that satisfy your use case, set M365_MCP_READ_ONLY=true when write access is not needed, require confirmation for mutating tools, and protect or exclude the auth directory from sync and backups because its tokens can grant account access if exposed.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Credential Access

High
Category
Privilege Escalation
Content
- Set `M365_MCP_READ_ONLY=true` for an enforced least-privilege mode. It requests
  read-only OAuth scopes, omits mutating tools from discovery, and rejects direct
  calls to them.
- Refresh and access tokens are stored as plaintext JSON under
  `~/.m365-mcp/auth/` (or `M365_MCP_AUTH_DIR`), protected with directory mode
  `0700` and file mode `0600` where supported. Protect that directory and revoke
  the app's Microsoft account consent if a token or device is compromised.
Confidence
97% confidence
Finding
The skill explicitly documents that refresh and access tokens are stored as plaintext JSON on disk. Even with 0700/0600 permissions, plaintext bearer tokens are highly sensitive credentials: malware, local privilege abuse, backups, sync tools, or accidental exposure of the auth directory could allow an attacker to replay the tokens and access the user's Microsoft 365 data without re-authentication.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.