WorkIQ

Query Microsoft 365 data (emails, meetings, documents, Teams messages, people) using WorkIQ CLI

This skill is coherent with its stated purpose, but review these practical points before installing: 1) The skill runs the WorkIQ CLI locally (or via npx). If you don't already trust the @microsoft/workiq package, prefer to install a vetted version yourself (npm install -g @microsoft/workiq) instead of using npx, which executes remote code on-demand. 2) Authentication is interactive: the agent cannot complete the sign-in for you — you'll need to run workiq ask manually to sign in and accept the EULA. 3) The skill does not request extra credentials, but when you run the CLI it will access Microsoft 365 data that the signed-in account can see—install and run only if you trust the CLI and the environment. 4) Note the small name mismatch between the registry entry and SKILL.md ("WorkIa" vs "workiq"); that's likely a metadata typo but verify you are installing the expected skill.

Type: OpenClaw Skill Name: workiq Version: 1.0.0 The skill is designed to query Microsoft 365 data using the WorkIQ CLI, a legitimate purpose. It instructs the agent to execute `workiq` or `npx @microsoft/workiq` commands, passing user questions as arguments. While this pattern inherently carries a risk of shell injection if the agent does not properly sanitize user input, the skill itself does not contain any explicit malicious instructions, data exfiltration attempts, persistence mechanisms, or obfuscation. Notably, it includes a guideline advising the agent *not* to pipe or combine WorkIQ output with other shell commands, which is a security-conscious instruction. The dependencies and commands used are standard for interacting with a CLI tool.