Office 365 Connector

Office 365 / Outlook connector for email (read/send), calendar (read/write), and contacts (read/write) using resilient OAuth authentication. NOW WITH MULTI-ACCOUNT SUPPORT! Manage multiple Microsoft 365 identities from a single skill. Solves the difficulty connecting to Office 365 email, calendar, and contacts. Uses Microsoft Graph API with comprehensive Azure App Registration setup guide. Perfect for accessing your Microsoft 365/Outlook data from OpenClaw.

What to consider before installing: - Source trust: The skill's source/homepage is unknown. The code and docs look consistent with an Office365 connector, but you should only install from authors you trust. Prefer official or well-known sources. - Metadata mismatches: The registry metadata does NOT declare required binaries or environment variables, yet the SKILL.md and scripts expect a Node runtime and may use AZURE_TENANT_ID / AZURE_CLIENT_ID / AZURE_CLIENT_SECRET as fallbacks. Treat those omissions as a packaging/quality issue and verify prerequisites before running. - Secrets handling: The skill stores client secrets and tokens in ~/.openclaw/auth/office365-accounts.json and per-account token files (mode 0600). Files are not encrypted. If you proceed, use a dedicated, minimal-privilege Azure App Registration, rotate secrets often, and avoid putting highly privileged tenant-wide credentials into this skill. - Least privilege: Only grant the Graph permissions you actually need. If you only need read-only, avoid enabling Mail.Send or ReadWrite scopes. Creating an app with the minimum delegated scopes reduces blast radius. - Review/scan the code: Because the source is unknown, inspect the JavaScript files (they're included) or have them audited. The network calls target Microsoft endpoints (login.microsoftonline.com and graph.microsoft.com), which is expected; nonetheless confirm there are no hidden remote endpoints or obfuscated code. - Run safely: Test in an isolated environment or throwaway account before connecting sensitive or corporate accounts. Consider creating a dedicated Azure AD app and test user with only the necessary permissions. If you can't verify the author or you are not comfortable with local secret storage, consider alternatives (official connectors, platform-provided integrations) or request a signed/reviewed release from a trusted maintainer.

Type: OpenClaw Skill Name: office365-connector Version: 2.0.0 This skill is classified as suspicious due to its broad and high-risk delegated permissions, including `Mail.ReadWrite`, `Mail.Send`, `Calendars.ReadWrite`, and `Contacts.ReadWrite`. While these permissions are explicitly declared in `SKILL.md` and `references/permissions.md` and are necessary for the skill's stated purpose as a comprehensive Office 365 connector, they grant extensive control over a user's email, calendar, and contacts. The skill demonstrates good security practices by storing credentials and tokens with restricted file permissions (0600) in `~/.openclaw/auth/` and communicating only with legitimate Microsoft OAuth and Graph API endpoints. There is no evidence of intentional malicious behavior, data exfiltration to unauthorized endpoints, or prompt injection attempts against the AI agent in the documentation.