Manages Microsoft 365 junk mail by analyzing spam patterns, scoring suspicious emails, and assisting with review or automatic cleanup of Outlook/Exchange spa...

This skill appears to implement what it claims (reading junk mail, scoring, labeling/moving messages via Microsoft Graph) but has a few inconsistencies you should handle before installing: - The skill expects an m365-mailbox profile and token cache under ~/.openclaw/secrets/m365-mailbox (clientId/tenant and token cache). The skill metadata does not declare these config paths — verify those files exist and inspect them before use. - The scripts will read and may write the token cache file. Make a backup of your token cache/profile before running and ensure you trust the author. - Confirm the Graph permissions requested (Mail.Read, Mail.ReadWrite) are appropriate for your use case. Prefer running in review/dry-run mode first (the code supports dry runs) before enabling any automatic 'move' operations. - The code pulls dependencies from npm. Ensure you run npm install in a controlled environment and run with a Node version compatible with @azure/msal-node (msal may require Node >=20). - Review the included scripts yourself (they are unobfuscated) or run them in a test account. There are no hidden network endpoints besides graph.microsoft.com and npm registries, but the registry source is unknown — prefer obtaining this skill from a trusted source or verifying the full code prior to use. If you need higher assurance, request the skill publisher's homepage or source repository, or ask for metadata updates that declare the required config paths and Node engine constraints. If you cannot inspect or verify the token/profile files, treat the skill as untrusted for production mailboxes.

Type: OpenClaw Skill Name: m365-spam-manager Version: 0.1.2 The OpenClaw AgentSkills skill bundle 'm365-spam-manager' is classified as benign. Its purpose is to analyze and manage Microsoft 365 spam, which it achieves by interacting with the Microsoft Graph API. The skill uses appropriate `Mail.Read` and `Mail.ReadWrite` permissions for its stated functions (reading, categorizing, and moving emails). Credential handling is secure, storing tokens and configuration in the expected `~/.openclaw/secrets/m365-mailbox` directory, and command-line arguments are properly sanitized (e.g., `encodeURIComponent` for URL parameters in `scripts/_graph.mjs`, `scripts/analyze.mjs`, `scripts/move-to-inbox.mjs`, `scripts/move-to-learning.mjs`). There is no evidence of malicious intent, data exfiltration to unauthorized endpoints, persistence mechanisms, or prompt injection attempts in `SKILL.md`.