Windows 日历同步

将提醒同步到 Windows / Outlook 日历。当用户提到「提醒我」「设置提醒」「加到日历」「同步到日历」「日程」「calendar」「日历」时，使用此技能。支持 Microsoft Graph API 设备代码流认证，无需 Web 服务器，直接写入用户 Outlook 日历。

What to consider before installing: - Hardcoded tenant ID: the code writes/uses a fixed TENANT_ID GUID (fbc75ead-...) rather than /common or letting you choose. Ask the author why this value is used. If unknown, do not use until explained—this could direct authentication to an unexpected tenant or change consent/behavior. - Use your own Client ID: the setup instructs you to register an Azure AD app and paste the Application (client) ID. Do not paste any other credentials. Verify you created the app and that its «Supported account types» and permissions are what you expect (Calendars.ReadWrite only). - Tokens are stored locally: token_store.json contains access/refresh tokens in your skills folder. Back it up if you need, and remove it if you revoke access. Treat that file as sensitive. - Network endpoints are Microsoft-only: the scripts call Microsoft endpoints (login.microsoftonline.com, graph.microsoft.com). There are no other external upload endpoints in the code. - Minimal technical checks you can do: inspect the scripts yourself to confirm no code posts tokens elsewhere; confirm the GUID (TENANT_ID) and, if uncomfortable, edit config.txt to use /common or your tenant before running; or run setup_and_auth.py and register the app but change endpoints to /common if you prefer. - If the author confirms the TENANT_ID is benign (e.g., a placeholder that should be replaced or known Microsoft tenant) and/or the code is updated to let you choose tenant or use /common, this would remove the main remaining concern and make the package coherent. Given the unexplained TENANT_ID and minor implementation oddities, proceed only after clarifying that point or after modifying the code to use a tenant value you control or /common.

Type: OpenClaw Skill Name: windows-calendar-sync Version: 1.0.0 The skill bundle contains hardcoded absolute file paths referencing a specific user profile directory ('C:\Users\johnx') throughout the SKILL.md instructions. While the underlying Python scripts (calendar_sync.py, authenticate.py, and setup_and_auth.py) appear to legitimately implement Microsoft Graph API calendar synchronization using standard OAuth2 device code flows, the hardcoded paths are a significant configuration flaw that would cause execution failures on most systems. This lack of portability and the specific user reference are suspicious, although no clear evidence of intentional malice, data exfiltration to third parties, or backdoors was identified.