Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Exchange2010

v1.0.0

Connect to Exchange 2010 to manage emails, calendar events, contacts, tasks, attachments, shared calendars, recurring events, and out-of-office settings.

0· 1.3k·2 current·2 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for pes0/exchange2010.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Exchange2010" (pes0/exchange2010) from ClawHub.
Skill page: https://clawhub.ai/pes0/exchange2010
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install exchange2010

ClawHub CLI

Package manager switcher

npx clawhub@latest install exchange2010
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
high confidence
Purpose & Capability
Name, SKILL.md examples and the included __init__.py implement Exchange 2010 EWS operations (email, calendar, contacts, tasks) — the requested capabilities match the code's purpose. However the skill's package metadata lists no required env vars while the code expects credentials, indicating a documentation/metadata mismatch.
!
Instruction Scope
SKILL.md instructs placing Exchange credentials in a .env.credentials file. The code will read a .env.credentials file located two directories above the module and set every KEY=VALUE it finds into os.environ (no filtering). That means the skill will import any keys present in that file (not only Exchange-related keys). Also SKILL.md references EXCHANGE_PASSWORD but the code reads PICARD_PASSWORD (and raises an error mentioning EXCHANGE_PASSWORD), creating confusion and potential runtime errors.
Install Mechanism
No install script or remote downloads are present. The skill is instruction/code-only and does not fetch remote artifacts during install.
!
Credentials
Registry metadata declares no required env vars but runtime requires credentials. The code expects PICARD_USERNAME / PICARD_PASSWORD and uses EXCHANGE_* fallbacks inconsistently. The practice of loading an arbitrary .env.credentials into os.environ (all keys) is disproportionate because it can import unrelated secrets into the process unexpectedly.
Persistence & Privilege
The skill does not request always:true, does not modify other skills, and has no install-time persistence mechanisms. It will run with normal autonomous invocation defaults.
What to consider before installing
Do not install blindly. The skill's functionality (Exchange EWS access) is plausible, but there are clear mismatches and risky behaviors around credentials: - SKILL.md asks you to put EXCHANGE_SERVER/EXCHANGE_DOMAIN/EXCHANGE_EMAIL/EXCHANGE_PASSWORD in .env.credentials, but the code actually reads PICARD_USERNAME and PICARD_PASSWORD (with EXCHANGE_* used as fallbacks in some places). This will likely cause runtime confusion or failures. - The module reads a .env.credentials file two directories up and indiscriminately injects every KEY=VALUE into os.environ. If that file also contains other secrets (AWS keys, tokens, etc.) those would be loaded into the agent process — a significant exposure risk. - The registry metadata lists no required environment variables; the skill should declare the credentials it needs so you can make an informed consent decision. What to do before installing: - Inspect the .env.credentials file and ensure it contains only the exact Exchange credentials you intend to expose (or better, do not store unrelated secrets there). - Ask the author to fix the inconsistent env variable names (either use EXCHANGE_PASSWORD everywhere or document PICARD_PASSWORD) and update the registry metadata accordingly. - Consider running this in a restricted environment (no access to other secrets) until the credential-loading behavior is fixed. - If you cannot verify or change the code, treat the skill as untrusted and avoid providing real secrets. If the author provides an updated version that documents required env vars correctly and only loads/uses the declared keys (instead of injecting the entire .env file into os.environ), the concerns would be largely resolved.

Like a lobster shell, security has layers — review code before you run it.

latestvk9717fxxyrac26pbmrz8w6vvpd80rfg7
1.3kdownloads
0stars
2versions
Updated 4h ago
v1.0.0
MIT-0

exchange2010

Exchange 2010 EWS integration for emails, calendar, contacts, and tasks.

Setup

Requires credentials in .env.credentials:

EXCHANGE_SERVER=mail.company.com
EXCHANGE_DOMAIN=company
EXCHANGE_EMAIL=user@company.com
EXCHANGE_PASSWORD=your_password

Features

  • Email: Read unread, send, search, mark as read
  • Email Attachments: Download, extract text (PDF, TXT)
  • Email Folders: Browse Sent, Drafts, Trash, Junk
  • Calendar: View, create, update, delete, search events
  • Recurring Events: Detect and manage series
  • Shared Calendars: Access other Exchange mailboxes
  • Contacts: Search address book, resolve names (GAL)
  • Tasks/To-Do: Manage, create, complete tasks
  • Out-of-Office: Read and set absence messages
  • EWS Filters: Fast search with subject__contains, start__gte, etc.
  • List Calendars: Show all calendar folders

Examples

Read Emails

from skills.exchange2010 import get_account, get_unread_emails

account = get_account()
emails = get_unread_emails(account, limit=10)
for email in emails:
    print(f"{email['subject']} from {email['sender']}")

Today's Events

from skills.exchange2010 import get_today_events

# Your own events
today = get_today_events()

# Events from shared calendar
today = get_today_events('shared@company.com')

Search Events

from skills.exchange2010 import search_calendar_by_subject
from datetime import date

# Fast search for Ekadashi
ekadashi = search_calendar_by_subject(
    email_address='shared@company.com',
    search_term='Ekadashi',
    start_date=date(2025, 1, 1),
    end_date=date(2026, 12, 31)
)
print(f"Found: {len(ekadashi)} events")

Create Event

from skills.exchange2010 import create_calendar_event
from datetime import datetime

create_calendar_event(
    subject="Team Meeting",
    start=datetime(2026, 2, 7, 14, 0),
    end=datetime(2026, 2, 7, 15, 0),
    body="Project discussion",
    location="Conference Room A"
)

Update Event

from skills.exchange2010 import update_calendar_event
from datetime import datetime

# Reschedule
update_calendar_event(
    event_id='AAQkAG...',
    start=datetime(2026, 2, 10, 14, 0),
    end=datetime(2026, 2, 10, 15, 0),
    location="New Room B"
)

Browse Email Folders

from skills.exchange2010 import get_folder_emails, list_email_folders

# List all folders
folders = list_email_folders(account)
for f in folders:
    print(f"{f['name']}: {f['unread_count']} unread")

# Sent Items
sent = get_folder_emails('sent', limit=10)

# Drafts
drafts = get_folder_emails('drafts')

# Trash
trash = get_folder_emails('trash')

Search Emails

from skills.exchange2010 import search_emails

# By sender
emails = search_emails(sender='boss@company.com', limit=10)

# By subject
emails = search_emails(subject='Invoice', folder='inbox')

# Unread only
emails = search_emails(is_unread=True, limit=20)

Mark Email as Read

from skills.exchange2010 import mark_email_as_read

mark_email_as_read(email_id='AAQkAG...')

Download Attachments

from skills.exchange2010 import get_email_attachments

# Show info
attachments = get_email_attachments(email_id='AAQkAG...')
for att in attachments:
    print(f"{att['name']}: {att['size']} bytes")

# Download
attachments = get_email_attachments(
    email_id='AAQkAG...',
    download_path='/tmp/email_attachments'
)

Extract Text from Attachments

Prerequisite: pip install PyPDF2 for PDF text extraction

from skills.exchange2010 import process_attachment_content

results = process_attachment_content(email_id='AAQkAG...')
for result in results:
    print(f"File: {result['name']}")
    if 'extracted_text' in result:
        print(f"Content: {result['extracted_text'][:500]}...")

Search Contacts

from skills.exchange2010 import search_contacts, resolve_name

# Search contacts
contacts = search_contacts('John Doe')
for c in contacts:
    print(f"{c['name']}: {c['email']}")

# Resolve name (GAL)
result = resolve_name('john.doe@company.com')
if result:
    print(f"Found: {result['name']} - {result['email']}")

Manage Tasks

from skills.exchange2010 import get_tasks, create_task, complete_task, delete_task
from datetime import datetime, timedelta

# Show open tasks
tasks = get_tasks()
for task in tasks:
    status = '✅' if task['is_complete'] else '⏳'
    print(f"{status} {task['subject']}")

# Create new task
task_id = create_task(
    subject="Finish report",
    body="Q1 report due Friday",
    due_date=datetime.now() + timedelta(days=3),
    importance="High"
)

# Mark as complete
complete_task(task_id)

# Delete
delete_task(task_id)

Find Recurring Events

from skills.exchange2010 import get_recurring_events

recurring = get_recurring_events(
    email_address='shared@company.com',
    days=30
)
for r in recurring:
    print(f"{r['subject']}: {r['recurrence']}")

Out-of-Office

from skills.exchange2010 import get_out_of_office, set_out_of_office
from datetime import datetime, timedelta

# Check status
oof = get_out_of_office()
print(f"Out of office active: {oof['enabled']}")

# Enable
set_out_of_office(
    enabled=True,
    internal_reply="I am on vacation until Feb 15th.",
    external_reply="I am on vacation until Feb 15th.",
    start=datetime.now(),
    end=datetime.now() + timedelta(days=7),
    external_audience='All'  # 'All', 'Known', 'None'
)

# Disable
set_out_of_office(enabled=False, internal_reply="")

Send Email

from skills.exchange2010 import send_email

send_email(
    to=["recipient@example.com"],
    subject="Test",
    body="Hello!",
    cc=["cc@example.com"]
)

API Reference

Email

FunctionDescription
get_account()Connect to Exchange
get_unread_emails(account, limit=50)Get unread emails
search_emails(search_term, sender, subject, is_unread, folder, limit)Search emails
send_email(to, subject, body, cc, bcc)Send email
mark_email_as_read(email_id)Mark as read
get_email_attachments(email_id, download_path)Download attachments
process_attachment_content(email_id, attachment_name)Extract text

Email Folders

FunctionDescription
get_folder_emails(folder_name, limit, is_unread)Emails from folder
list_email_folders(account)List all folders

Calendar

FunctionDescription
get_today_events(email_address)Today's events
get_upcoming_events(email_address, days)Next N days
get_calendar_events(account, start, end)Events in range
get_shared_calendar_events(email, start, end)Shared calendar
search_calendar_by_subject(email, term, start, end)Fast search
create_calendar_event(subject, start, end, body, location)Create event
update_calendar_event(event_id, ...)Update event
get_event_details(event_id)Show details
delete_calendar_event(event_id)Delete event
get_recurring_events(email, start, end)Recurring events
list_available_calendars(account)List calendars
count_ekadashi_events(email, start_year)Count Ekadashi

Contacts

FunctionDescription
search_contacts(search_term, limit)Search contacts
resolve_name(name)Resolve name (GAL)

Tasks

FunctionDescription
get_tasks(status, folder)Get tasks
create_task(subject, body, due_date, importance, categories)Create task
complete_task(task_id)Mark complete
delete_task(task_id)Delete task

Out-of-Office

FunctionDescription
get_out_of_office(email_address)Read status
set_out_of_office(enabled, internal_reply, ...)Set OOF

Notes

  • Exchange 2010 SP2 explicitly used as version
  • DELEGATE access type for own and shared mailboxes
  • EWS Filters (subject__contains, start__gte) are faster than iteration
  • Timezones: Automatic conversion to EWSDateTime with UTC
  • 27 functions available in total

Comments

Loading comments...