Microsoft 365 Graph Openclaw

Microsoft 365 Graph for OpenClaw with webhook-based wake signals. Reduce recurring LLM cost from inbox polling while managing Outlook mail, calendar, OneDriv...

This repo appears to implement the described push-mode Graph integration, but you should not run the provided privileged setup scripts without review. Before installing: - Audit the setup scripts (run_mail_webhook_e2e_setup.sh, setup_mail_webhook_ec2.sh, run_mail_webhook_smoke_tests.sh, diagnose scripts) to see exactly what they install and what files they write under /etc and systemd. Use --dry-run where provided. - Do not rely on the default public client_id (Alitar) for production — register your own Entra app and use its client_id so tokens are under your control. - Expect to provide and securely store OPENCLAW_HOOK_TOKEN, OPENCLAW_HOOK_URL, and GRAPH_WEBHOOK_CLIENT_STATE; the registry metadata currently does not declare these env vars (metadata/documentation mismatch). Ensure these values are managed by a secrets manager and rotated if exposed. - Inspect state/graph_auth.json handling: it contains access/refresh tokens. Ensure the state directory permissions are locked down and is gitignored (the docs state it is ignored, but verify before committing). - If you will allow the scripts to patch OpenClaw config, back up ~/.openclaw/openclaw.json first and review any automated changes; prefer manual edits in sensitive/production environments. - If you cannot audit scripts or do not want services installed on the host, consider running the adapter/worker in a contained environment (container or separate VM) and avoid running the setup scripts with sudo. Given the privileged persistence and the metadata mismatch around required secrets, treat this skill as suspicious until you've completed the checks above and replaced the test client_id with one you control.

Type: OpenClaw Skill Name: microsoft-365-graph-openclaw Version: 0.2.2 The skill provides a complex Microsoft Graph integration with a push-based webhook architecture. It includes several high-risk shell scripts (scripts/setup_mail_webhook_ec2.sh and scripts/run_mail_webhook_e2e_setup.sh) that require root privileges to install systemd services, modify Caddy configurations, and programmatically patch the main OpenClaw configuration file (openclaw.json). While these actions are documented and aligned with the stated goal of automating a production-grade deployment, the broad system-level modifications and the use of a hardcoded third-party Client ID (952d1b34-682e-48ce-9c54-bac5a96cbd42) by default represent a significant security risk and attack surface.