Security audit
Security checks across malware telemetry and agentic risk
Mog is a legitimate Microsoft 365 CLI, but it needs Review because it can send, change, and delete live account data and stores broad OAuth access tokens in file storage by default.
Install only if you are comfortable granting this tool broad delegated access to your Microsoft 365 account. Prefer a least-privileged or isolated Azure app, use keychain storage when possible, treat ~/.config/mog/tokens.json as sensitive if file storage is used, and avoid letting an agent run delete, clear, send, or update commands without explicit human review.
// SaveTokensAuto saves tokens using the current storage type.
func SaveTokensAuto(tokens *Tokens) error {
switch CurrentStorage {
case StorageKeyring:
return SaveTokensKeyring(tokens)
default:
return SaveTokens(tokens)func SaveTokensAuto(tokens *Tokens) error {
switch CurrentStorage {
case StorageKeyring:
return SaveTokensKeyring(tokens)
default:
return SaveTokens(tokens)
}// LoadTokensAuto loads tokens using the current storage type.
func LoadTokensAuto() (*Tokens, error) {
switch CurrentStorage {
case StorageKeyring:
return LoadTokensKeyring()
default:
return LoadTokens()func LoadTokensAuto() (*Tokens, error) {
switch CurrentStorage {
case StorageKeyring:
return LoadTokensKeyring()
default:
return LoadTokens()
}63/63 vendors flagged this skill as clean.
No suspicious patterns detected.