Microsoft 365

Microsoft 365 integration for Outlook, Calendar, Contacts, and OneDrive via Microsoft Graph API. Supports reading/sending emails, managing calendar events, a...

This skill appears to do what it claims: a local Microsoft Graph client using Device Code Flow. Before installing, consider the following: (1) Tokens and refresh tokens are stored locally under ~/.openclaw/credentials/ms365.tokens.<account>.json — treat those files as sensitive and don't share them. (2) The skill will load an optional ~/.openclaw/credentials/ms365.env and will respect OPENCLAW_HOME if set — verify that file's contents before use. (3) When you register the Azure app, limit OAuth scopes to the minimum needed (the bundled scopes are broad and allow file and mail write access). (4) There's a small documentation mismatch (README reference to tokens.json) — if you rely on repository-local token storage, be aware the code writes to ~/.openclaw instead. (5) Review the included source if you need assurance; network calls go to Microsoft endpoints only. If you want stricter guarantees, create a dedicated Azure app with minimal scopes and test in a low-privilege account first.

Type: OpenClaw Skill Name: microsoft365 Version: 1.0.2 The skill is classified as suspicious primarily due to a potential path traversal vulnerability in the `uploadFile` function within `src/api.js`. The `fileName` parameter, which can be user-controlled, is directly interpolated into the Microsoft Graph API URL path (`/me/drive/root:/${fileName}:/content`). If the Graph API does not sufficiently sanitize or restrict `fileName` (e.g., against `../` sequences), an attacker could potentially upload files to unintended locations within the user's OneDrive. Additionally, the skill requests broad permissions (`Files.ReadWrite.All`, `Mail.Send`, `Calendars.ReadWrite`, `Contacts.ReadWrite`), which, while necessary for its stated functionality, increase the impact if any vulnerability were exploited. There is no evidence of intentional malicious behavior like exfiltration to unauthorized endpoints or prompt injection in `SKILL.md`.