Security checks for vulnerabilities and agentic risk
Overview
The skill matches its Microsoft 365 email and calendar purpose, but it gives an agent broad send/delete/schedule authority and recommends an unpinned global CLI install without enough safeguards.
Review this skill before installing. Use a pinned and verified ms365 CLI version if possible, avoid broad delegated permissions, keep authentication revocation/logout available, and require the agent to ask for explicit confirmation before sending mail, deleting or moving messages, creating meetings with attendees, or deleting calendar events.
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
T08 · Insecure Dependencies
Warning
Location
SKILL.md:27
Finding
Unpinned Global Installation of a Privileged Third-Party npm Package
Content
View full analysis
Vulnerability Details
File Location: SKILL.md, lines 27–31 Vulnerability Type: Supply-chain exposure through an unpinned, globally installed dependency Risk Level: Medium
Vulnerable Code
markdown
## Prerequisites
Before using this skill, ensure the `ms365` CLI package is installed on the local system or available via `npx`.
```bash
# To install globally:
npm install -g ms365
text
### Technical Analysis
The Skill instructs the user to install the latest available release of the `ms365` npm package globally. It does not specify an exact reviewed version, integrity hash, lockfile, verified publisher, or authoritative package source.
npm packages can run lifecycle scripts during installation. Consequently, a compromised, replaced, or unexpectedly changed package release could execute code with the installing user's privileges. The global installation scope also places package files and executables outside the Skill directory, increasing their reach and lifetime.
This concern is amplified by the package's intended role. After installation, the user authenticates it to Microsoft 365, and the Skill uses it to access email, calendars, contacts, and authentication state. The audit found no evidence that the documented package is currently malicious; the vulnerability is the unsafe and insufficiently reproducible dependency installation process.
The flagged network behavior elsewhere in the Skill is consistent with its declared Microsoft 365 functionality. No unrelated network destination, covert exfiltration instruction, embedded malicious script, persistence mechanism, or instruction-hijacking behavior was found.
### Attack Path
1. An attacker compromises the npm package, its publisher account, or a future package release.
2. A user follows the documented `npm install -g ms365` command.
3. npm retrieves the attacker-controlled release because no exact version or integrity constraint is speci
...[truncated 1261 chars]
Remediation
View remediation
Remediation Suggestions
Pin the dependency to an exact, security-reviewed version rather than installing the latest release:
bash
Use --ignore-scripts only after confirming that the package does not legitimately require lifecycle scripts.
Document the package's authoritative registry URL, publisher identity, source repository, and expected integrity digest.
Prefer a project-local, locked, or isolated installation over npm install -g. Commit an appropriate lockfile when applicable.
Verify package provenance and integrity before installation, and monitor the pinned version for advisories or publisher changes.
Review the package contents and lifecycle scripts before approving upgrades. Upgrade only through an explicit review process.
Document the exact Microsoft Graph delegated permissions required and grant only the minimum scopes needed for requested operations.
Separate read-only permissions from destructive or outbound actions where practical. Require explicit user confirmation before sending email, inviting attendees, permanently deleting messages, or deleting calendar events.
Store authentication tokens using operating-system-protected credential storage and provide clear token revocation and logout procedures.
The activation description uses very broad trigger phrases like 'read my email', 'send an email', and 'check my calendar', which can cause the skill to be invoked in many loosely related contexts involving highly sensitive mailbox and calendar data. Because this skill enables both data access and state-changing actions, over-broad routing increases the chance of unintended execution, privacy exposure, or accidental destructive/outbound operations.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding
This section documents email send, move, delete, and folder-management operations without requiring user-facing confirmation or warning language for destructive and outbound actions. In an agent setting, these commands can disclose information to third parties, permanently alter mailbox state, or hard-delete content if invoked from ambiguous or stale user intent.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding
The calendar section allows creating, deleting, and modifying recurring events without warning that these actions may notify attendees, cancel meetings, remove user data, or affect multiple future events. In a productivity agent, silent execution of these actions can cause significant business disruption and unintended communication with other people.
