M365 Calendar (Graph)

• Analyzed: May 12, 2026, 4:18 AM
• Findings: 0
• Version: 0.1.9
• Hash: 3810ddcf7b4ebf1bf555f3484144cacee92d0d592abdf538047013ef16351b27
• Source: palm
• External report: View on VirusTotal

Overview

Type: OpenClaw Skill Name: m365-calendar Version: 0.1.9 The skill bundle is classified as suspicious due to a potential Local File Inclusion (LFI) vulnerability in `scripts/import-raw-token.mjs`. This script directly reads the content of a file specified by the `--file` argument (`fs.readFileSync(file, 'utf8')`) without path sanitization. While this script is a utility and not part of the primary operational workflow described in `SKILL.md` for the AI agent, the vulnerability exists within the bundle and could be exploited if an attacker could prompt the agent to use this script with an arbitrary file path. All other scripts and the `SKILL.md` appear to align with the stated purpose of M365 calendar automation, using standard authentication practices and appropriate permissions.