outlook-web

SUSPICIOUS. The read-only purpose broadly matches the capabilities, and there is no explicit third-party exfiltration or remote installer chain. However, the skill is high-trust: it reuses a live signed-in browser profile and local session store instead of official scoped API auth, giving the agent indirect access to sensitive enterprise content and tokens. The prompt-injection surface is inherent and partially acknowledged, but the browser-profile trust model is broader than a narrowly scoped read-only API integration.