📦 MS Forms Auto — 实用工具
v1.0.0自动化 Microsoft Forms daily submissions 使用 M365 MFA 支持 和 dual-calendar 集成 auto-fill training, 内容 dev, 和 learning hours.
0· 115·1 当前·1 累计
by 安全扫描
OpenClaw
安全
high confidenceThe skill's code and runtime instructions match its stated purpose (automating Microsoft Forms submissions via Playwright + MFA + calendar data); it asks for sensitive local credentials and calendar URLs but does not contain hidden endpoints or incoherent requirements.
评估建议
This skill appears to do what it says, but it requires highly sensitive data and local persistence. Before installing: 1) Prefer a dedicated/limited M365 account (not your primary interactive account) if possible. 2) Keep config/credentials.json and config/calendars.json protected (file mode 600, ensure they are in .gitignore and not backed up to untrusted services). 3) Be aware the skill saves browser storageState (cookies/tokens) and HTML/screenshots which can contain personal information—clea...详细分析 ▾
✓ 用途与能力
Name/description (MS Forms automation, dual calendars, M365 MFA) align with the included scripts: calendar fetching, Playwright-based login & submission, MFA handling, and credential setup. No unrelated services or env vars are requested.
ℹ 指令范围
SKILL.md instructs the user to save M365 email/password to config/credentials.json and to provide calendar URLs (config/calendars.json) that can contain auth tokens. Scripts also save storageState.json and produce screenshots/HTML (login-debug, login-debug screenshots). All of these actions are coherent with automating login/submission but mean sensitive data (passwords, session cookies, calendar tokens, HTML snapshots) are stored locally. The scripts do not appear to read unrelated system files or call external endpoints outside calendar URLs and Microsoft domains.
ℹ 安装机制
No special install spec in registry, but package.json requires playwright (pulled from npm) and the README expects 'npm install' and 'npx playwright install chromium' which downloads browser binaries. This is a standard but non-trivial install (Playwright downloads large browser artifacts). The sources are public npm/Playwright (not arbitrary URLs).
ℹ 凭证需求
No environment variables are requested. The skill requires storing M365 credentials (email/password) and calendar URLs/tokens in local config files. These are proportionate to the described functionality, but they are sensitive and merit careful handling (file permissions, gitignore, consider using a dedicated service account or limited account).
✓ 持久化与权限
The skill does persist data (storageState.json, credentials.json, calendars.json, screenshots) but does not request always:true or system-wide privileges. Persisting auth state and credentials is expected for this automation, but it increases the blast radius if the filesystem containing these files is exposed.
⚠ scripts/calendar-fetch.js:26
File read combined with network send (possible exfiltration).
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
安装命令
点击复制官方npx clawhub@latest install ms-forms-auto
镜像加速npx clawhub@latest install ms-forms-auto --registry https://cn.longxiaskill.com