Skill

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 7:55 PM UTC
• Version: 1.0.1

Overview

This is a disclosed Microsoft 365 CLI helper with broad tenant access, so it should be used carefully but does not show hidden or malicious behavior.

Install only from a trusted npm source, consider pinning a reviewed @pnp/cli-microsoft365 version, avoid username/password authentication, use least-privilege Microsoft 365 accounts or app permissions, and confirm before allowing the agent to run commands that create, modify, delete, or broadly enumerate tenant data.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14

Finding

Unpinned npm Dependency Installation and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14–22 and 53–60
Vulnerability Type: Unpinned third-party package installation and execution
Risk Level: Medium

Vulnerable Code

Lines 14–22:

json

"npmPackages": ["@pnp/cli-microsoft365"]
},
"install":
[
  {
    "id": "node",
    "kind": "node",
    "package": "@pnp/cli-microsoft365",
    "label": "Install m365 CLI (npm)",
    "description": "Install the CLI for Microsoft 365 globally: npm install -g @pnp/cli-microsoft365"

Lines 53–60:

bash

## Installation

The CLI must be installed:
```bash
npm install -g @pnp/cli-microsoft365

Or use npx (sandbox):

bash

npx @pnp/cli-microsoft365 --help

Technical Analysis

The skill directs the agent to retrieve and execute @pnp/cli-microsoft365 without specifying an exact reviewed version or integrity value. Consequently, npm resolves the package to the version represented by the applicable current distribution tag at installation time rather than to immutable audited content.

The global installation command can install package files and expose commands across the user's environment. The npx alternative may download and execute package code immediately. npm lifecycle scripts and transitive dependencies can also run or be loaded as part of installation and execution. The listed official repository and package URLs provide provenance information, but they do not cryptographically bind the installed artifact to a reviewed release.

No evidence indicates that the named package is currently malicious. The vulnerability is the unsafe, mutable dependency acquisition process and the resulting exposure to a compromised future release, compromised transitive dependency, registry compromise, or account takeover.

Attack Path

1. An attacker compromises the package publisher, a transitive dependency, or the package-distribution channel and publishes malicious co ...[truncated 1501 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an exact reviewed version in both metadata and command examples, avoiding version ranges and mutable distribution tags.
2. Maintain a lockfile that records exact transitive dependency versions and integrity hashes.
3. Prefer a project-local installation over npm install -g to reduce system-wide impact and make dependency state reproducible.
4. Avoid executing an implicitly downloaded package through unpinned npx. If npx is retained, require an exact reviewed version and configure it not to accept an unexpected package download silently.
5. Verify package integrity and publisher provenance before installation. Where supported, use npm provenance attestations, trusted registry controls, and an approved internal package mirror.
6. Disable npm lifecycle scripts during installation where compatible, then explicitly enable only required and reviewed setup operations.
7. Run installation and the CLI in a least-privileged isolated environment without unrelated secrets, sensitive environment variables, or broad filesystem access.
8. Authenticate using a least-privileged Microsoft 365 identity and restrict application permissions to the workloads required for the task.
9. Establish a controlled dependency-update process in which new package and transitive dependency versions are reviewed and tested before the pinned version is changed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This skill advertises broad tenant-management and data-access capabilities across SharePoint, Teams, OneDrive, Outlook, Planner, and Entra ID, but it does not warn that these commands may expose sensitive organizational data or modify production resources. In an agent setting, that omission increases the chance of overbroad or unsafe use of powerful administrative commands.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The skill instructs use of npx @pnp/cli-microsoft365 without pinning a specific version, which makes execution depend on whatever package version is current at runtime. That creates a supply-chain risk: a compromised upstream release or unexpected breaking behavior could be pulled and executed immediately in an authenticated Microsoft 365 context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The authentication section lists several login methods, including client secrets and username/password, without emphasizing that these credentials and resulting sessions grant sensitive tenant access. In a skill intended for agents, this can normalize insecure secret handling or encourage users to provide credentials without proper storage, scoping, and approval controls.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.