outlookcli

Manage personal Microsoft account (Outlook.com / Hotmail / Live) email, calendar, and OneDrive via the m365-cli command-line tool. Use for personal email/cal...

Security Scan

The skill's instructions and requirements are consistent with a wrapper for the third-party m365-cli tool to manage a personal Microsoft account; nothing requested is disproportionate to that purpose.

Purpose & Capability

The SKILL.md explicitly documents use of the m365-cli to manage personal Outlook/OneDrive/Calendar and the listed commands match that purpose. Minor inconsistency: registry metadata reported no required binaries/install, whereas the SKILL.md declares required-binary: m365 and gives an npm install command — but this is plausibly an authoring omission rather than malicious.

Instruction Scope

Instructions are limited to running the m365 CLI for mail/calendar/OneDrive operations, using --json for structured output, and authenticating via the CLI's device-code flow. The instructions do reference reading/writing local files only where appropriate (attachments, uploads, downloads). They do not ask the agent to read unrelated system files or to exfiltrate data to unexpected endpoints.

Install Mechanism

This is an instruction-only skill (no install spec in registry), but the SKILL.md tells the user to run `npm install -g m365-cli`. Installing a third-party npm package is a normal, moderate-risk action; the skill itself will not silently download code because it contains no install script. Users should verify the npm package and GitHub repo referenced in SKILL.md before installing.

Credentials

No sensitive environment variables are required by the skill. Authentication is performed interactively via m365 login (device-code flow) and the CLI requests typical scopes for mail, calendar, and files (including offline_access for refresh tokens) — this is expected for a persistent client that manages email/OneDrive.

Persistence & Privilege

The skill is not forced-always and has default autonomous invocation allowed. The only persistence implication is that the m365 CLI stores authentication tokens locally (standard for OAuth CLI tools); the skill itself does not request system-wide config changes or other skills' credentials.

Assessment

This skill is a set of instructions to use the third-party m365-cli tool. Before installing or using it: 1) Verify the npm package and GitHub repo (mrhah/m365-cli) to ensure you trust the publisher; 2) Understand that m365 login stores OAuth tokens locally and requests offline_access (refresh tokens) — use m365 logout to clear them when done; 3) The agent will run shell commands and may read/write files you instruct it to attach or download, so avoid attaching sensitive files unless necessary; 4) Note the minor metadata mismatch (registry says no install/binaries while SKILL.md requires m365/npm) — consider installing m365-cli yourself and reviewing its source rather than letting an agent install things automatically.

Outlook Skill (m365-cli)

Manage a personal Microsoft account (Outlook.com / Hotmail / Live) via the m365 CLI. Use --json for structured output suitable for AI agent consumption (most commands support it).

Prerequisites

• Node.js 18+
• m365-cli installed globally: npm install -g m365-cli
• Authenticated: m365 login --account-type personal

If not authenticated, run login first. The CLI uses Device Code Flow — follow the on-screen URL and code.

Key Conventions

• Use --json for programmatic output (most commands support it; trust/untrust do not).
• Personal accounts support: Mail (including delete, move, and folder management), Calendar, OneDrive, User search. Not SharePoint.
• Calendar datetime format: YYYY-MM-DDTHH:MM:SS (local) or YYYY-MM-DD (all-day).
• IDs: Email/event IDs are long opaque strings. Parse the id field from --json list/search output.
• Timezone: auto-detected. Override: export M365_TIMEZONE="Asia/Shanghai".

Provenance

• Source repo: https://github.com/mrhah/m365-cli
• Package: https://www.npmjs.com/package/m365-cli
• Publisher: mrhah
• Required binary: m365 from the m365-cli npm package

Quick Workflow Reference

Authentication

m365 login --account-type personal    # First-time login
m365 logout                           # Clear credentials

Mail

# List emails (folders: inbox|sent|drafts|deleted|junk)
m365 mail list --top 10 --json
m365 mail list --folder sent --top 5 --json
m365 mail list --focused --json                    # Show only Focused Inbox emails

# Read / send / search
m365 mail read <id> --force --json
m365 mail send "[e-mail]" "Subject" "Body" --json
m365 mail send "[e-mail]" "Subject" "Body" --attach file.pdf --cc "[e-mail]" --json
m365 mail search "keyword" --top 20 --json

# Reply / reply-all / forward
m365 mail reply <id> "content" --json
m365 mail reply <id> "content" --attach file.pdf --json
m365 mail reply-all <id> "content" --json
m365 mail reply-all <id> "content" --attach a.pdf b.pdf --json
m365 mail forward <id> "[e-mail]" "comment" --json
m365 mail forward <id> "[e-mail]" "FYI" --attach report.pdf --json

# Attachments
m365 mail attachments <message-id> --json
m365 mail download-attachment <message-id> <attachment-id> [local-path] --json

# Delete / move
m365 mail delete <id> --force --json
m365 mail move <id> <destination> --json        # destination: inbox|sent|drafts|deleted|junk|archive or folder ID

# Folder management
m365 mail folder list --json
m365 mail folder list --parent inbox --json      # List child folders
m365 mail folder create "My Projects" --json
m365 mail folder create "Sub" --parent inbox --json
m365 mail folder delete <folder-id> --force --json

# Trusted senders whitelist
m365 mail trusted --json
m365 mail trust [e-mail]
m365 mail trust @example.com          # Trust entire domain
m365 mail untrust [e-mail]

Calendar

# List / get
m365 cal list --days 7 --json
m365 cal get <event-id> --json

# Create
m365 cal create "Title" --start "2026-03-10T14:00:00" --end "2026-03-10T15:00:00" --json
m365 cal create "Title" -s "2026-03-10T14:00:00" -e "2026-03-10T15:00:00" \
  --location "Room A" --body "Notes" --attendees "[e-mail],[e-mail]" --json
m365 cal create "Holiday" --start "2026-03-20" --end "2026-03-21" --allday --json

# Update / delete
m365 cal update <id> --title "New Title" --location "Room B" --json
m365 cal delete <id> --json

OneDrive

# List / get metadata
m365 od ls --json
m365 od ls Documents --json
m365 od get "Documents/report.pdf" --json

# Download / upload
m365 od download "Documents/report.pdf" ~/Downloads/ --json
m365 od upload ~/Desktop/photo.jpg "Photos/vacation.jpg" --json

# Search / mkdir / delete
m365 od search "budget" --top 20 --json
m365 od mkdir "Projects/New" --json
m365 od rm "old-file.txt" --force --json

For sharing, invitations, and advanced OneDrive options, see references/commands.md.

User Search

m365 user search "John" --top 5 --json    # Searches contacts and people

Common Patterns

Read and reply to email

m365 mail list --top 5 --json                    # 1. Find email
m365 mail read <id> --force --json               # 2. Read content
m365 mail reply <id> "Reply content" --json      # 3. Reply

Reply with attachment

m365 mail reply <id> "See attached" --attach report.pdf --json

Forward with attachment

m365 mail forward <id> "[e-mail]" "FYI" --attach data.xlsx --json

Check calendar and schedule

m365 cal list --days 3 --json                    # 1. Check availability
m365 cal create "Meeting" -s "..." -e "..." --json  # 2. Book slot

Download email attachment

m365 mail attachments <msg-id> --json            # 1. List attachments
m365 mail download-attachment <msg-id> <att-id> ~/Downloads/ --json  # 2. Download

Delete and organize email

m365 mail list --top 10 --json                   # 1. Find email
m365 mail delete <id> --force --json              # 2a. Delete it, OR
m365 mail move <id> archive --json                # 2b. Move to archive

Manage mail folders

m365 mail folder list --json                      # 1. List all folders
m365 mail folder create "Projects" --json         # 2. Create custom folder
m365 mail move <id> <folder-id> --json            # 3. Move email into it

Trusted Senders (Security)

m365 mail read filters untrusted sender content (shows metadata only). Use --force to bypass. See references/commands.md for whitelist management commands.

Full Command Reference

See references/commands.md for every command, subcommand, flag, and default value.

Troubleshooting

• "Not authenticated": m365 login --account-type personal
• Token expired: Auto-refreshes. If fails, re-run login.
• SharePoint errors: Personal accounts don't support SharePoint.
• Wrong timezone: export M365_TIMEZONE="Your/Timezone"

Security & Privacy

This skill accesses personal email, calendar, files, and contacts — all sensitive PII.

• Never read, output, or log ~/.m365-cli/credentials.json — it contains OAuth tokens.
• Never include full email bodies or attachment contents in agent output unless the user explicitly requested that specific email.
• Summarize email content instead of echoing it verbatim when presenting results to the user.
• Credential refresh is automatic; never attempt to manually edit or parse the token file.
• When listing emails, prefer showing metadata (subject, sender, date) over full body content.