outlook

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill stores client secrets and OAuth tokens in local files and explicitly exposes a command that "prints access token" (./scripts/outlook-token.sh get), which would require the agent to read and output secret values verbatim.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.95). Outsider-authored free text from the user’s own Outlook mailbox is fetched at runtime via Microsoft Graph (e.g., outlook-mail.sh read → GET /me/messages/$FULL_ID?... and extracts body.content into body, and outlook-calendar.sh read → GET /me/calendar/events/$FULL_ID and extracts body.content), then that text is emitted as plain JSON that the agent would ingest into its LLM context.