MS Forms Auto

Automate Microsoft Forms daily submissions with M365 MFA support and dual-calendar integration to auto-fill training, content dev, and learning hours.

This skill appears to do what it says, but it requires highly sensitive data and local persistence. Before installing: 1) Prefer a dedicated/limited M365 account (not your primary interactive account) if possible. 2) Keep config/credentials.json and config/calendars.json protected (file mode 600, ensure they are in .gitignore and not backed up to untrusted services). 3) Be aware the skill saves browser storageState (cookies/tokens) and HTML/screenshots which can contain personal information—clean or remove them if you stop using the skill. 4) Review calendar URLs you paste into config (they may contain embedded tokens); treat them like secrets. 5) Run first tests manually in a controlled environment (headed mode) to confirm behavior; review screenshots/HTML outputs. 6) If you cannot accept storing your M365 password locally, do not install; consider using a service account, token-based integration, or an IT-approved automation solution instead.

Type: OpenClaw Skill Name: ms-forms-auto Version: 1.0.0 The skill bundle provides a comprehensive suite of scripts for automating Microsoft Forms submissions using Playwright, including handling M365 MFA and fetching data from external calendars. While the code appears to be a legitimate automation tool, it possesses high-risk capabilities such as browser automation, network access to user-provided calendar URLs, and the local storage of plain-text M365 credentials and session cookies in the 'config/' directory (e.g., credentials.json, storageState.json). These capabilities, although aligned with the stated purpose, represent a significant attack surface and potential for credential compromise, fitting the criteria for a 'suspicious' classification due to inherent risk rather than demonstrated malice.