Teams Delegate

Delegate Microsoft Teams inbox management to your AI agent for auto-replies, message summaries, priority filtering, and context-aware responses.

This skill appears to do what it says, but review a few items before installing: - Permissions: The Azure app requires powerful Graph scopes (read/write chat, send channel messages). Granting these lets the app read your Teams messages and send messages as you — only proceed if you trust the code and the maintainer. - Admin consent: On corporate tenants you may need admin consent. If you are an employee, consult your IT/security team before granting these permissions to avoid policy violations. - Local tokens: The tool stores auth data under ~/.teams-delegate (token cache and config). Ensure your home directory has appropriate file permissions and remove the token files if you stop using the skill. - Dependencies: The scripts use the Python 'msal' library but the SKILL.md doesn't list how to install it. Install msal (pip install msal) and verify Python versions before running. - Documentation mismatch: SKILL.md claims token.json but the code writes token_cache.bin and config.json — expect the code behavior (check ~/.teams-delegate for the actual files). If you want extra assurance: inspect the scripts locally (they are small and readable) and run them in a controlled account or tenant with limited privileges before pointing them at your primary work account.

Type: OpenClaw Skill Name: teams-delegate Version: 1.0.4 The skill requests broad Microsoft Graph API permissions (e.g., Chat.ReadWrite, ChannelMessage.Send, User.Read) which, while necessary for its stated purpose of delegating Teams inbox management, grant significant control over the user's Teams account. More critically, the SKILL.md instructs the AI agent to 'use cron or heartbeat' for auto-reply mode. This is a direct prompt injection vulnerability, as an agent capable of executing shell commands could be instructed to create arbitrary cron jobs, potentially leading to persistence or unauthorized execution if the agent's environment is not properly sandboxed. All network communication is directed to the legitimate Microsoft Graph API (graph.microsoft.com), and there is no evidence of intentional data exfiltration or malicious execution within the provided code.