Ms365 Tenant Manager

Microsoft 365 tenant administration for Global Administrators. Automate M365 tenant setup, Office 365 admin tasks, Azure AD user management, Exchange Online...

This skill contains ready-to-run PowerShell and Python generators that will create and execute high-privilege Microsoft 365 actions. Before installing or using it: (1) only use in a non-production/test tenant first and review every generated script; (2) do not grant Global Admin or broad Graph scopes to untrusted code — prefer a least-privilege app registration with only required permissions or use managed identities/secure vaults; (3) remove or avoid examples that embed client secrets or use plaintext ConvertTo-SecureString -AsPlainText; store secrets in a secure secret manager and use certificate-based app auth where possible; (4) restrict agent/autonomous invocation or require explicit human approval before running scripts that change Conditional Access, license assignments, or revoke sessions; (5) verify there are no hard-coded secrets in the repository and audit logs after any run. If you cannot validate the author/source or cannot safely provide least-privilege credentials, do not enable this skill against production tenants.

Type: OpenClaw Skill Name: ms365-tenant-manager Version: 2.1.1 The ms365-tenant-manager bundle provides tools for Microsoft 365 administration but contains vulnerabilities in its script generation logic. Specifically, the Python modules (powershell_generator.py, tenant_setup.py, and user_management.py) construct PowerShell scripts by embedding input parameters directly into f-strings without sanitization or escaping. This lack of input validation creates a risk of PowerShell injection if an attacker can influence the input data (e.g., user names, policy names, or company names). While the bundle's stated purpose is legitimate and it promotes security best practices in its documentation, the underlying code generation lacks the necessary safeguards to prevent exploitation.