技能 Microsoft Graph API
📦

Microsoft Graph API

v0.3.0 內容修訂 r1 高風險 🌐 網路存取⚙️ 外部命令📁 檔案系統存取🔑 環境變數

管理 Outlook 郵件和行事曆

Microsoft 365 郵件和行事曆任務通常需要經過驗證的 Graph API 呼叫。此技能提供用於讀取訊息、傳送郵件、列出事件以及建立行事曆項目的指令碼。

支援: Claude Codex Code(CC)
Maintain this Skill? Claim it ⚠️ 38 差

使用我的智慧代理安裝

將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。

智能體請求
Review the Skillstore skill "Microsoft Graph API" from https://skillstore.io/skills/bltgv-microsoft-graph-api.md and its manifest at https://skillstore.io/api/skills/bltgv-microsoft-graph-api/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。

Agent 可讀資源

當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。

Markdown 詳情 GET /skills/bltgv-microsoft-graph-api.md 已簽名 manifest GET /api/skills/bltgv-microsoft-graph-api/manifest 已簽名 lockfile GET /api/skills/bltgv-microsoft-graph-api/lockfile

測試它

正在使用「Microsoft Graph API」。 顯示我的未讀收件匣訊息。

預期結果:

一份精簡的未讀訊息清單，包含寄件者、主旨、接收時間、已讀狀態和本文預覽。

正在使用「Microsoft Graph API」。 我本週有哪些會議？

預期結果:

一份依時間排序的議程，包含事件標題、開始和結束時間、地點、召集人，以及可用時的與會者狀態。

正在使用「Microsoft Graph API」。 傳送一封後續追蹤電子郵件給專案團隊。

預期結果:

在電子郵件送出前，顯示收件者、主旨和郵件本文的確認請求。

安全審計

高風險
v9 • 2026/7/19 開啟版本化報告

Most static alerts are false positives caused by TypeScript template literals, Markdown backticks, example identifiers, and official Microsoft URLs. Confirmed risks include OAuth network operations, immediate email sending, and plaintext credential storage. Semantic review also found weak secret-file permissions, indirect prompt-injection exposure, and unconfirmed calendar creation.

11
已掃描檔案
2,369
分析行數
9
複核項目
0
已忽略的誤報

已確認的安全問題 (4)

高
scripts/lib/credentials.ts:7
Credential JSON file
const CREDENTIALS_FILE = join(CONFIG_DIR, "credentials.json");
This path is used to persist Microsoft Graph access and refresh tokens as plaintext JSON. Disclosure of the file can grant delegated mailbox and calendar access.
高
scripts/lib/credentials.ts:22-24scripts/lib/pending-auth.ts:51-53
OAuth Secret Files Lack Restrictive Permissions
Credential and pending-auth files contain tokens or device codes. The write operations do not set restrictive modes, so other local users may read them.
Both functions write sensitive JSON with writeFile and no mode option. Default permissions depend on umask and can permit local disclosure.
高
scripts/emails.ts:222-238scripts/calendar.ts:210-224
Indirect Prompt Injection Exposure
Email bodies and calendar text are returned directly to the agent. Malicious content may influence later email or calendar actions without an untrusted-data boundary.
The scripts return externally controlled message bodies and event fields verbatim. The skill instructions provide no rule to treat retrieved content only as data.
中
scripts/calendar.ts:335-400SKILL.md:148-169
Calendar Creation Has No Confirmation Gate
The create command posts events and attendee invitations immediately. The skill does not require a final user review of subject, time, or recipients.
The create branch validates required fields and posts immediately. The usage instructions show direct create commands without a confirmation step.
能力複核項目 (9)

這些是真實的本機能力，對此技能而言可能是預期行為，因此需要複核，但不會按已確認的惡意行為計分。

高
scripts/emails.ts:325
Email sending capability
await graphPost(token, "/me/sendMail", { message });
This call sends a message through the authenticated mailbox immediately. The script has no recipient preview or explicit confirmation gate before the external side effect.
低
scripts/calendar.ts:125
Fetch API call
const response = await fetch(url, {
The fetch sends an OAuth bearer token to Microsoft Graph and accesses mailbox or calendar data. The destination is fixed and legitimate, but the network capability is security-relevant.
低
scripts/calendar.ts:143
Fetch API call
const response = await fetch(url, {
The fetch sends an OAuth bearer token to Microsoft Graph and accesses mailbox or calendar data. The destination is fixed and legitimate, but the network capability is security-relevant.
低
scripts/emails.ts:122
Fetch API call
const response = await fetch(url, {
The fetch sends an OAuth bearer token to Microsoft Graph and accesses mailbox or calendar data. The destination is fixed and legitimate, but the network capability is security-relevant.
低
scripts/emails.ts:140
Fetch API call
const response = await fetch(url, {
The fetch sends an OAuth bearer token to Microsoft Graph and accesses mailbox or calendar data. The destination is fixed and legitimate, but the network capability is security-relevant.
低
scripts/lib/device-code.ts:45
Fetch API call
const response = await fetch(url, {
The fetch performs OAuth device-code, token, or refresh exchanges with Microsoft identity endpoints. This is expected, but it transmits authentication material over the network.
低
scripts/lib/device-code.ts:87
Fetch API call
const response = await fetch(url, {
The fetch performs OAuth device-code, token, or refresh exchanges with Microsoft identity endpoints. This is expected, but it transmits authentication material over the network.
低
scripts/lib/device-code.ts:152
Fetch API call
const response = await fetch(url, {
The fetch performs OAuth device-code, token, or refresh exchanges with Microsoft identity endpoints. This is expected, but it transmits authentication material over the network.
低
scripts/lib/graph-client.ts:155
Fetch API call
const response = await fetch(`https://graph.microsoft.com/v1.0${endpoint}`, {
The fetch sends an OAuth bearer token to Microsoft Graph and accesses mailbox or calendar data. The destination is fixed and legitimate, but the network capability is security-relevant.

風險因素

🌐 網路存取 (25)
references/graph-api.md:241 scripts/auth.ts:77 scripts/auth.ts:83 scripts/auth.ts:171 scripts/calendar.ts:125 scripts/calendar.ts:143 scripts/calendar.ts:123 scripts/calendar.ts:141 scripts/emails.ts:122 scripts/emails.ts:140 scripts/emails.ts:120 scripts/emails.ts:138 scripts/emails.ts:325 scripts/lib/device-code.ts:45 scripts/lib/device-code.ts:87 scripts/lib/device-code.ts:152 scripts/lib/device-code.ts:38 scripts/lib/device-code.ts:78 scripts/lib/device-code.ts:142 scripts/lib/graph-client.ts:155 scripts/lib/graph-client.ts:62 scripts/lib/graph-client.ts:155 SKILL.md:33 SKILL.md:42 SKILL.md:55
⚙️ 外部命令 (50)
scripts/auth.ts:57-104 scripts/auth.ts:120 scripts/auth.ts:121 scripts/auth.ts:122 scripts/auth.ts:124 scripts/auth.ts:127 scripts/auth.ts:129 scripts/auth.ts:140 scripts/auth.ts:142 scripts/auth.ts:155 scripts/auth.ts:156 scripts/auth.ts:158 scripts/auth.ts:160 scripts/auth.ts:163 scripts/auth.ts:165 scripts/auth.ts:171 scripts/auth.ts:178 scripts/auth.ts:179 scripts/auth.ts:180 scripts/auth.ts:181 scripts/auth.ts:199 scripts/auth.ts:200 scripts/auth.ts:201 scripts/calendar.ts:66-113 scripts/calendar.ts:123 scripts/calendar.ts:127 scripts/calendar.ts:134 scripts/calendar.ts:141 scripts/calendar.ts:146 scripts/calendar.ts:154 scripts/calendar.ts:287 scripts/calendar.ts:305 scripts/calendar.ts:325 scripts/calendar.ts:410 scripts/emails.ts:65-110 scripts/emails.ts:120 scripts/emails.ts:124 scripts/emails.ts:131 scripts/emails.ts:138 scripts/emails.ts:143 scripts/emails.ts:151 scripts/emails.ts:198 scripts/emails.ts:224 scripts/emails.ts:252 scripts/emails.ts:273 scripts/emails.ts:339 scripts/lib/auth-handler.ts:66-79 scripts/lib/auth-handler.ts:79-194 scripts/lib/device-code.ts:38 scripts/lib/device-code.ts:55
📁 檔案系統存取 (3)
scripts/lib/graph-client.ts:116 SKILL.md:210 SKILL.md:210
🔑 環境變數 (2)
scripts/lib/graph-client.ts:105 scripts/lib/graph-client.ts:105
審計單位: codex 檢視審計紀錄 →
分享與引用此報告

分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。

開啟版本化報告
安全評估

複製報告連結

https://skillstore.io/skills/bltgv-microsoft-graph-api/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/bltgv-microsoft-graph-api/security.svg)](https://skillstore.io/skills/bltgv-microsoft-graph-api?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/bltgv-microsoft-graph-api?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/bltgv-microsoft-graph-api/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/bltgv-microsoft-graph-api.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
學術引用 (APA · BibTeX · CFF)

APA 引用

BLTGV. (2026). Microsoft Graph API security audit report (audit version 9) [Author version 0.3.0]. Skillstore. https://skillstore.io/skills/bltgv-microsoft-graph-api/audits/9

BibTeX 引用

@techreport{bltgv-bltgv-microsoft-graph-api-2026, author = {BLTGV}, title = {Microsoft Graph API security audit report (audit version 9)}, institution = {Skillstore}, year = {2026}, number = {9}, url = {https://skillstore.io/skills/bltgv-microsoft-graph-api/audits/9}, note = {Author version 0.3.0} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "Microsoft Graph API security audit report (audit version 9)" version: "0.3.0" type: report authors: - name: "BLTGV" date-released: "2026-07-19" url: "https://skillstore.io/skills/bltgv-microsoft-graph-api/audits/9" identifiers: - type: other value: "skillstore:bltgv-microsoft-graph-api:audit:9" description: "Skillstore immutable audit report identifier"

Skillstore 評分

評分依據 證據置信度: 中
64
架構
100
可維護性
87
內容
71
社群
74
規範符合度

你可以打造什麼

檢閱近期郵件

摘要近期 Outlook 訊息、搜尋重要寄件者，並在需要時開啟特定電子郵件內容。

管理每日排程

檢查今天、本週或自訂日期範圍內的 Microsoft 365 行事曆事件。

自動化 Graph 工作流程

使用已驗證的指令碼，從代理工作流程傳送訊息或建立會議。

試試這些提示

列出近期收件匣郵件 
顯示我最近 10 封 Outlook 收件匣訊息，包含寄件者、主旨、接收時間和簡短預覽。
依主題尋找訊息 
搜尋我上週 Outlook 郵件中關於 [topic] 的訊息。摘要符合的主旨和寄件者。
規劃行事曆事件 
為 [meeting name] 在 [date and time] 建立行事曆事件，並加入 [attendees]。建立前請先與我確認所有詳細資訊。
協調郵件和行事曆 
尋找 [person] 關於 [project] 的電子郵件，識別任何提議的會議時間，並草擬一個行事曆事件供我核准。

最佳實務

  • 傳送電子郵件前，先與使用者確認收件者、主旨和本文。
  • 為工作和個人帳戶使用不同的設定檔。
  • 讀取訊息或事件時，要求最小必要的資料範圍。

避免

  • 未取得使用者明確核准前，請勿傳送電子郵件或建立事件。
  • 當特定搜尋已足夠時，請勿要求廣泛的信箱資料。
  • 請勿將共用帳戶或服務帳戶權杖儲存在使用者設定檔中。

常見問題

此技能會存取哪些 Microsoft 服務？
它會透過 Microsoft Graph 存取 Outlook 郵件和 Microsoft 365 行事曆資料。
它需要驗證嗎？
是。它使用 Microsoft device code authentication，並將產生的權杖儲存在本機。
它可以傳送電子郵件嗎？
可以。當登入的帳戶授予 Mail.Send 權限時，它可以傳送電子郵件。
它可以建立行事曆事件嗎？
可以。當登入的帳戶授予行事曆寫入權限時，它可以建立事件。
認證會儲存在哪裡？
指令碼會將 OAuth 認證儲存在使用者設定目錄下的 JSON 檔案中。
它會自動處理大型結果集嗎？
不會。它使用 top 值限制結果，且未實作完整分頁。

開發者詳細資訊

作者

BLTGV

授權

MIT

作者版本

v0.3.0

Skillstore 修訂

r1

儲存庫

https://github.com/BLTGV/agent-skills/tree/master/skills/microsoft-graph

引用

1b5b6c4962b2ad5a7a34603cab2685bbbd1b61ef

維護新鮮度

2026/7/18

使用量

18 次下載 · 246 次瀏覽

檔案結構

📁 references/

📄 graph-api.md

📁 scripts/

📄 auth.ts

📄 calendar.ts

📄 emails.ts

📁 lib/

📄 auth-handler.ts

📄 credentials.ts

📄 device-code.ts

📄 graph-client.ts

📄 pending-auth.ts

📄 types.ts

📄 SKILL.md

BLTGV 的更多技能

查看全部

相關技能

查看全部