ms365-cli Security Report — Low Risk | ClawSafe

10 /100

ms365-cli

Manage Microsoft 365 Emails and Calendar using the ms365 CLI tool

Well-documented Microsoft 365 CLI wrapper that declares shell access and all capabilities transparently with no hidden functionality detected.

Skill Namems365-cli

Duration24.1s

Enginepi

✓

Safe to install

Skill is safe to use. Consider pinning ms365 CLI version in prerequisites to mitigate supply chain risks.

Findings 1 items

Severity	Finding	Location
Low	ms365 CLI package not version pinned Supply Chain The SKILL.md instructs users to install ms365 with 'npm install -g ms365' without specifying a version, which could result in running a compromised future version. `npm install -g ms365` → Pin to specific version: npm install -g [email protected]	`SKILL.md:21`

Resource	Declared	Inferred	Status	Evidence
Shell	`WRITE`	`WRITE`	✓ Aligned	SKILL.md declares bash tool, restricted to ms365 CLI
Network	`READ`	`READ`	✓ Aligned	Microsoft Graph API calls via ms365 CLI (documented)
Filesystem	`NONE`	`NONE`	—	No file operations documented
Environment	`NONE`	`NONE`	—	No env access documented or inferred
credential_theft	`NONE`	`NONE`	—	Explicitly states user must authenticate manually; agent cannot access tokens

1 files · 9.7 KB · 219 lines

Markdown 1f · 219L

└─ 📝 SKILL.md Markdown 219L · 9.7 KB

Package	Version	Source	Known Vulns	Notes
`ms365`	`*`	npm	No	Version not pinned - potential supply chain risk

✓ Comprehensive documentation covering all capabilities

✓ Explicitly states agent cannot authenticate on behalf of user (credential protection)

✓ Authentication requires manual user action via device code flow

✓ All operations are read-only or user-initiated mutations clearly documented

✓ No base64, eval, or obfuscation patterns detected

✓ No hidden functionality or shadow operations

✓ No credential harvesting or environment variable access

✓ Token lifecycle properly documented with logout capability