outlook-calendar

该技能目的表面合理，但实现方式明显偏离最小权限原则：它要求明文 Microsoft 365 凭据，并将密码、Cookie、Token 交给未验证来源的本地脚本处理，而不是采用官方 Graph/OAuth 授权流程。未见已确认恶意外传证据，因此更适合判为可疑/高风险而非确认恶意。

This module is a high-sensitivity authentication automation script: it reads plaintext credentials from a local config file, automates the Microsoft login/MFA waiting process, and then saves browser cookies to disk for later reuse. While it does not show obfuscation or direct exfiltration in the snippet and only targets Microsoft/Outlook endpoints, the local persistence of full authentication cookies and potential capture of MFA-related screenshots make it a significant security risk if introduced via an untrusted supply-chain dependency. Strongly protect ~/.outlook/config.json and ~/.outlook/cookies.json (permissions, encryption-at-rest, and access controls), and restrict distribution/usage to trusted environments.