microsoft-365

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt includes explicit examples that assign CLIENT_SECRET (and other credentials) as literal strings and shows passing them directly into ClientSecretCredential, which encourages embedding secret values verbatim in generated code/commands and creates an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill explicitly reads and processes user-generated content from Microsoft Graph — e.g., emails and bodies in references/mail/mail-api.md and scripts/mail/list_messages.py (message.body.content), Teams messages in references/teams/teams-api.md (list_channel_messages / get_chat_messages), and OneDrive file downloads in references/files/files-api.md and scripts/files/onedrive_operations.py — and uses that content to drive actions like sending messages, creating events, or modifying files, which could allow indirect prompt injection from untrusted third-party content.