Mog

• Outcome: Review
• Latest audit: Jul 10, 2026 · 2:24 AM UTC
• Version: 0.3.1

Overview

Mog is a legitimate Microsoft 365 CLI, but it needs Review because it can send, change, and delete live account data and stores broad OAuth access tokens in file storage by default.

Install only if you are comfortable granting this tool broad delegated access to your Microsoft 365 account. Prefer a least-privileged or isolated Azure app, use keychain storage when possible, treat ~/.config/mog/tokens.json as sensitive if file storage is used, and avoid letting an agent run delete, clear, send, or update commands without explicit human review.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill advertises and documents capabilities that imply network access, file writes, and use of local credential/token files, but it does not declare permissions. This creates a transparency and consent problem: an agent or user may invoke a skill that can access Microsoft 365 data and write local files without explicit permission gating or clear security boundaries.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The skill documents destructive or data-affecting operations such as sending mail, deleting calendar items, removing drive files, clearing tasks, deleting contacts, updating spreadsheets, and deleting OneNote content without warning users about irreversible effects or the need for confirmation. In an agent context, this increases the risk of accidental data loss, unintended outbound communication, or unauthorized modification of cloud data.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The delete command permanently removes a task immediately after invocation, with no confirmation prompt, dry-run mode, or safeguard against operator mistakes. In a CLI that manipulates live Microsoft 365 data, mistyped IDs, shell history reuse, or automation bugs can cause unintended data loss.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The clear command enumerates all completed tasks in a list and deletes them in bulk without any pre-execution warning or confirmation. Bulk destructive actions amplify the impact of user error, wrong-list selection, or accidental invocation, especially because the default behavior may target the first available list when no list ID is supplied.

Credential Access

High

• Category: Privilege Escalation

Content

// SaveTokensAuto saves tokens using the current storage type.
func SaveTokensAuto(tokens *Tokens) error {
	switch CurrentStorage {
	case StorageKeyring:
		return SaveTokensKeyring(tokens)
	default:
		return SaveTokens(tokens)

• Confidence: 79% confidence
• Finding: The auto-save wrapper can persist OAuth tokens using a globally selected backend, and this file sets the default storage to "file" rather than keyring. In a Microsoft 365 CLI, saving reusable OAuth tokens to disk by default can expose access and refresh tokens if file permissions are weak, backups are accessible, or the host is shared, making this context more dangerous because the tokens grant access to mail, files, and other tenant data.

Credential Access

High

• Category: Privilege Escalation

Content

func SaveTokensAuto(tokens *Tokens) error {
	switch CurrentStorage {
	case StorageKeyring:
		return SaveTokensKeyring(tokens)
	default:
		return SaveTokens(tokens)
	}

• Confidence: 79% confidence
• Finding: This dispatch to SaveTokensKeyring appears benign in isolation, but within SaveTokensAuto it highlights that backend choice is driven by mutable global state while the file backend remains the default. The main risk is not keyring use itself; it is that automatic credential persistence may silently choose weaker file storage for high-value Microsoft 365 OAuth tokens.

Credential Access

High

• Category: Privilege Escalation

Content

// LoadTokensAuto loads tokens using the current storage type.
func LoadTokensAuto() (*Tokens, error) {
	switch CurrentStorage {
	case StorageKeyring:
		return LoadTokensKeyring()
	default:
		return LoadTokens()

• Confidence: 76% confidence
• Finding: Automatic token loading from a globally chosen backend can retrieve long-lived OAuth credentials from a file-based cache if the application defaults remain unchanged. In this skill context, those tokens may unlock broad Microsoft 365 resources, so relying on a weaker default storage mechanism increases the blast radius of local compromise.

Credential Access

High

• Category: Privilege Escalation

Content

func LoadTokensAuto() (*Tokens, error) {
	switch CurrentStorage {
	case StorageKeyring:
		return LoadTokensKeyring()
	default:
		return LoadTokens()
	}

• Confidence: 76% confidence
• Finding: This line participates in the auto-load path that depends on a mutable global storage setting. While loading from keyring is fine, the broader design permits silent use of a less secure file store for sensitive Microsoft 365 tokens, which can materially increase risk on multi-user systems or compromised endpoints.

VirusTotal

63/63 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.