Ms Todo Oauth

A robust CLI skill to manage Microsoft To Do tasks via Microsoft Graph API. Supports full task lifecycle management including lists, tasks with priorities, due dates, reminders, recurrence patterns, views, search, and data export. Includes comprehensive test suite for reliability. THIS IS A REVISED OAUTH2-BASED VERSION OF ms-todo-sync with AI ASSISTANCE. ALL CREDITS TO THE ORIGINAL AUTHOR.

What to consider before installing or running this skill: - The package explicitly contains an Azure client_id (visible) and, per SKILL.md, a client_secret embedded in scripts/ms-todo-oauth.py. Hard-coded client secrets in distributed code are risky: they may be leaked, abused, or revoked without your knowledge. Expect the code to use those credentials unless you replace them. - Prefer creating your own Azure app registration and replacing the client_id/client_secret in the code (or better: modify the script to read client_id and client_secret from environment variables or a local config file). If you use the included secret, treat it as untrusted and rotate/revoke it after use. - Tests will run real operations against your Microsoft account (create/delete lists, add/delete tasks). Run tests only on an account you control and are willing to let the test suite modify. Consider creating a disposable Microsoft account for testing. - Inspect scripts/ms-todo-oauth.py yourself before running. Look for the client_secret literal (SKILL.md gives search strings like client_id="ca6ec244…" and client_secret="TwQ8Q…") and remove or replace it. Verify no other remote endpoints or data-exfiltration code exist (the README claims all API calls go to graph.microsoft.com, which matches the visible code, but double-check the rest of the file). - The package documentation and test suite use 'uv run' in many examples; that wrapper may not be installed on your system. The package will still run with python3 directly, but tests/examples may fail if you follow docs verbatim. - If you lack the ability to audit code, do not run this against your primary Microsoft account. Instead, run in an isolated environment and with credentials you can revoke. - If you decide to proceed: (1) audit the repository for the hard-coded secret and remove or replace it, (2) adjust the code to read credentials from environment variables, (3) run tests on a disposable account, and (4) consider scanning the package with additional static analysis tools.

Type: OpenClaw Skill Name: ms-todo-oauth Version: 1.0.4 The skill is classified as suspicious due to a critical security vulnerability: the hardcoded Azure AD application client ID and client secret in `scripts/ms-todo-oauth.py`. While the `SKILL.md` documentation acknowledges this and suggests replacement, its presence in the distributed code makes the application highly susceptible to compromise if the secret is leaked or revoked. This is a significant flaw that allows potential attacks, rather than proof of intentional malicious behavior. All network calls are directed to `graph.microsoft.com`, and no other indicators of malice (e.g., data exfiltration to unauthorized endpoints, persistence mechanisms, or prompt injection attempts against the agent) were found.