office-whisperer

CRITICAL: The `outlook-generator.ts` contains a direct `eval()` call within the `evaluateCondition` helper function used for advanced mail merge. This allows arbitrary code execution if the `conditional.condition` argument can be controlled by an attacker or manipulated by an LLM. Additionally, numerous file system operations (`fs.writeFile`, `fs.readFile`) are performed based on user-provided `filename` or `outputPath` arguments, which could be vulnerable to path traversal attacks if input is not properly sanitized by the calling agent. Outlook IMAP/SMTP configurations are passed directly in tool arguments, exposing sensitive credentials if not handled securely by the caller.