ms-todo-sync

A CLI skill to manage Microsoft To Do tasks via Microsoft Graph API. Supports listing, creating, completing, deleting, searching tasks and lists, viewing overdue/today/pending tasks, and exporting data.

This skill appears to be what it claims: a Microsoft To Do CLI that uses MSAL device-code flow and stores tokens locally. Before installing: (1) review the full scripts/ms-todo-sync.py file yourself (the provided file preview was truncated here), (2) run in an isolated Python virtualenv (uv or pip install -r requirements.txt) rather than globally, (3) be aware the token cache (~/.mstodo_token_cache.json) is stored unencrypted—treat it like a password and delete or revoke tokens when no longer needed, (4) if you prefer, register your own Azure AD app and supply your own client ID instead of using the built-in default, and (5) confirm network calls are only to microsoftonline.com / graph.microsoft.com during your review. If you cannot review the full code, exercise caution or request the complete source before use.

Type: OpenClaw Skill Name: ms-todo-sync Version: 1.0.2 The OpenClaw skill 'ms-todo-sync' is a benign CLI tool designed to manage Microsoft To Do tasks via the Microsoft Graph API. The code and documentation align perfectly with its stated purpose, utilizing the official Microsoft Authentication Library (MSAL) for secure authentication and directing all API calls to legitimate Microsoft Graph endpoints. There is no evidence of data exfiltration, malicious execution, persistence mechanisms beyond token caching, or obfuscation. The `SKILL.md` explicitly instructs the agent to handle destructive operations and authentication with user confirmation, mitigating prompt injection risks for these sensitive actions. The hardcoded client ID is a public identifier for Microsoft Graph API samples, not a secret, and poses no security threat.