Security audit

Outlook Email

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly transparent about email access, but it mixes high-impact mailbox permissions with some under-scoped calendar instructions and persistent mailbox-rule behavior that deserves review before install.

Install only with least-privilege Microsoft Graph consent. Start with Mail.Read for triage, avoid Mail.Send and MailboxSettings.ReadWrite unless you trust the runtime to enforce draft-first sending, recipient allowlists, and safe inbox-rule actions. Treat calendar scheduling as out of scope unless you deliberately add a separate calendar tool and confirm timezone and event details.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence

Findings (15)

Credential Access

High

Category: Privilege Escalation
Content: - Mail.Send - MailboxSettings.ReadWrite - User.Read - offline_access token_storage: >- Reference runtime (email-agent-mcp) stores OAuth tokens in the OS keychain via MSAL with @azure/identity-cache-persistence. No raw
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

Category: Privilege Escalation
Content: - Mail.Send - MailboxSettings.ReadWrite - User.Read - offline_access token_storage: >- Reference runtime (email-agent-mcp) stores OAuth tokens in the OS keychain via MSAL with @azure/identity-cache-persistence. No raw
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Tool Parameter Abuse

High

Category: Tool Misuse
Content: | List folders | `GET /me/mailFolders?$top=100` | Root only; recurse childFolders for nested | | Create folder | `POST /me/mailFolders` with `{"displayName": "..."}` | Optionally under a parent: `POST /me/mailFolders/{parentId}/childFolders` | | Move email | `POST /me/messages/{id}/move` with `{"destinationId": "<folder-id>"}` | POST, not PATCH | | Delete folder | `DELETE /me/mailFolders/{id}` | Rejects system folders (inbox, sentitems, etc.) | **Gotchas**: - `$select` does NOT work on PATCH requests — returns 400. Only use `$select` on GET.
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

Category: Tool Misuse
Content: |-----------|----------| | List rules | `GET /me/mailFolders/inbox/messageRules` | | Create rule | `POST /me/mailFolders/inbox/messageRules` | | Delete rule | `DELETE /me/mailFolders/inbox/messageRules/{id}` | ### Rule Security Model
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Context Leakage

High

Category: Data Exfiltration
Content: - **Reading**: `GET /me/messages/{id}/attachments` returns attachment metadata and content - **Drafting with attachments**: Include file paths in the draft; the MCP or API call handles upload - **Size limits**: Graph API accepts up to 4MB inline; larger files require an upload session ## 11. Composing Drafts via REST
Confidence: 85% confidence
Finding: Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Session Persistence

Medium

Category: Rogue Agent
Content: name: outlook-email description: >- Manage Outlook and Microsoft 365 email with AI agents — triage inbox by sender trust, draft replies with tone matching, organize folders, create inbox rules, and monitor for priority messages. Use when user says "check my email," "triage inbox," "organize email," "email cleanup," "outlook folders," "inbox rules," "draft a reply," "email summary," "unread messages," "email heartbeat," or
Confidence: 84% confidence
Finding: The skill advertises creating inbox rules and monitoring the mailbox, both of which can create durable effects beyond the current session. In this context, persistence is security-relevant because inbox rules can silently reroute, hide, or exfiltrate messages after the agent is gone, especially if paired with MailboxSettings.ReadWrite and autonomous invocation.

Vague Triggers

Medium

Confidence: 96% confidence
Finding: The trigger phrases are broad, everyday language such as 'check my email' and 'draft a reply,' which can cause over-activation in multi-tool agents. Because this skill can operate with high-impact Graph scopes like Mail.Send and MailboxSettings.ReadWrite, accidental invocation could expose mailbox contents or perform mailbox changes when the user intended something narrower.

Unrestricted Tool Access

Medium

Category: Excessive Agency
Content: | Layer | Enforcement mechanism | |-------|----------------------| | **Reference runtime (email-agent-mcp)** | Send allowlist empty by default. Action-level blocks on `forwardTo`, `forwardAsAttachmentTo`, `redirectTo`, `delete`, `permanentDelete` in [`rules.ts:39`](https://github.com/UseJunior/email-agent-mcp/blob/main/packages/email-core/src/actions/rules.ts#L39). `delete_email` disabled by default in [`label.ts`](https://github.com/UseJunior/email-agent-mcp/blob/main/packages/email-core/src/actions/label.ts). | | **Network policy (NemoClaw)** | Can block `graph.microsoft.com/v1.0/me/sendMail` at the network layer via custom policy, eliminating send capability entirely | | **Raw Graph API client** | Instruction-level only. Relies on the agent honoring the draft-first instructions. **Not recommended for safety-critical use** — pair with one of the runtime layers above |
Confidence: 70% confidence
Finding: Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The document tells users calendar integration is out of scope, then later instructs the agent to use calendar events for deadline-based action items. That contradiction can cause an agent runtime to invoke an unintended calendar-capable tool or request broader permissions than the user expected, weakening scope boundaries and user consent assumptions.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The reference materially expands an email-management skill into calendar scheduling and event creation, introducing capabilities beyond the declared scope. Scope expansion is dangerous because agents and users may rely on the manifest to understand what data domains and actions are in play, and undeclared calendar operations increase the chance of over-privileged consent and surprising side effects.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: Free/busy lookup and event creation are not justified by the stated purpose of inbox triage and email management, so they represent unnecessary privilege and functionality creep. If implemented under the same trust boundary, they could expose calendar metadata or create meetings without users reasonably expecting that behavior from an email-focused skill.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: Imposing a default timezone for scheduling without clear user opt-in can cause meetings to be created at unintended times, especially for distributed teams. In a workflow that creates calendar events, incorrect timezone assumptions can have real operational impact and are unsafe when the skill has write access.

Natural-Language Policy Violations

Low

Confidence: 88% confidence
Finding: The document includes Chinese section subtitles such as "使用 AI 代理管理 Outlook 邮件" and "安全模型" alongside English content, but it does not explain the language choice or offer a user opt-in/selection. That can conflict with a language/locale policy requiring user choice rather than an imposed language presentation.

Description-Behavior Mismatch

Low

Confidence: 88% confidence
Finding: The manifest declares calendar integration as out of scope, yet the skill content explicitly references creating calendar events as a communication/action mechanism. Even though the text tries to limit this as a reference use case, it expands the described behavior beyond pure email management.

Missing User Warnings

Low

Confidence: 82% confidence
Finding: The document states that local draft files may be mutated by auto-appending frontmatter fields, but it does not pair that behavior with an explicit warning or consent expectation. Silent file mutation can surprise users, interfere with automation, and create integrity/privacy issues if local files are assumed to be immutable inputs.

Static analysis

No suspicious patterns detected.