Ms Graph Calendar

Find available meeting times and free/busy slots for company employees using Microsoft Graph API. Use when user asks to schedule a meeting, find a free slot,...

This skill appears to implement what it claims (find free/busy via Microsoft Graph) but contains a few security inconsistencies you should address before use: - Do not run this on a shared machine without changes: get-token.js prints the raw access token to stdout and writes it to a temp file in the system temp directory. That token could be captured by logs or read by other local users/processes. Consider editing get-token.js to remove the console.log of the access token and to write the token file with restrictive permissions (e.g., fs.writeFileSync(path, data, { mode: 0o600 })). - If you prefer not to store credentials on disk, set AZURE_* env vars in a secure runtime (CI secret store, environment with restricted access) and avoid running setup.js. - Ensure the Azure App has least privilege: only grant Calendars.Read and User.Read.All as needed, and follow the README's recommendation to apply an App Access Policy in Exchange Online so the app cannot read all mailboxes unless required. Have an admin grant consent rather than using broader rights. - After testing, rotate the client secret if you accidentally exposed it (e.g., pasted it into chat or console logs). Remove the token file from /tmp if it exists. - Minor doc/code mismatches: curl is listed as required but not used by the scripts; SKILL.md mentions a device code flow though the code uses client credentials flow. If you do not control the registry/source, prefer reviewing the code and running it in an isolated environment (container or VM) before giving it production credentials. If you cannot or will not make these changes, treat the skill as risky and avoid installing it on multi-user systems or where console output is logged/collected.

Type: OpenClaw Skill Name: ms-graph-calendar Version: 1.0.2 This skill bundle is designed to interact with the Microsoft Graph API for calendar and user information. It requests read-only permissions (`Calendars.Read`, `User.Read.All`). Credentials (`AZURE_TENANT_ID`, `AZURE_CLIENT_ID`, `AZURE_CLIENT_SECRET`) are stored securely in `~/.openclaw/ms-graph-calendar.json` with `0o600` permissions by `scripts/setup.js`. Access tokens are temporarily stored in `os.tmpdir()` by `scripts/get-token.js`. All network communication is directed to `login.microsoftonline.com` and `graph.microsoft.com`. User inputs are sanitized using `encodeURIComponent` before being included in API requests. The `SKILL.md` provides clear, transparent instructions for the AI agent, explicitly stating read-only access and no logging of credentials, with no evidence of prompt injection attempts or malicious intent.