openclaw/sharepoint-by-altf1be
abdelkrim/sharepoint-by-altf1be/SKILL.md
Secure SharePoint file operations and Office document intelligence via Microsoft Graph API — certificate auth, Sites.Selected, read/write Word (mammoth), Excel (exceljs), PowerPoint (jszip), PDF (pdf-parse).
$ install --global
skillsauthnpx skillsauth add openclaw/skills sharepoint-by-altf1beInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 3, 2026, 7:57 AM4.7s1 file scanned
SKILL.md
SharePoint by @altf1be
Interact with SharePoint document libraries via Microsoft Graph API using certificate-based authentication.
Setup
- Create an Entra app with
Sites.Selectedpermission and certificate auth - Grant site-level write access via Microsoft Graph PowerShell
- Set environment variables (or create
.envin{baseDir}):
SP_TENANT_ID=your-azure-tenant-id
SP_CLIENT_ID=your-app-client-id
SP_CERT_PATH=/path/to/certificate.pem
SP_SITE_ID=your-sharepoint-site-id
SP_DRIVE_ID=optional-specific-drive-id
- Install dependencies:
cd {baseDir} && npm install
Commands
File operations
# Show site and drive info
node {baseDir}/scripts/sharepoint.mjs info
# List files in library root
node {baseDir}/scripts/sharepoint.mjs list
# List files in a subfolder
node {baseDir}/scripts/sharepoint.mjs list --path "Meeting Notes/2026"
# Read file content (extracts text from Office formats)
node {baseDir}/scripts/sharepoint.mjs read --path "Report.docx"
# Upload a file
node {baseDir}/scripts/sharepoint.mjs upload --local ./report.docx --remote "Reports/Q1-2026.docx"
# Search for files
node {baseDir}/scripts/sharepoint.mjs search --query "quarterly review"
# Create folder
node {baseDir}/scripts/sharepoint.mjs mkdir --path "Meeting Notes/2026"
# Delete (requires --confirm flag)
node {baseDir}/scripts/sharepoint.mjs delete --path "Drafts/old-file.txt" --confirm
Coauthoring (checkout/checkin)
# Safe edit: checkout → upload modified file → checkin (recommended)
node {baseDir}/scripts/sharepoint.mjs edit --path "Report.docx" --local ./modified.docx --comment "Updated summary"
# Check out a file (lock for exclusive editing)
node {baseDir}/scripts/sharepoint.mjs checkout --path "Report.docx"
# Check in a file (unlock + publish)
node {baseDir}/scripts/sharepoint.mjs checkin --path "Report.docx" --comment "Reviewed and approved"
# Get an edit link to open in Office Online
node {baseDir}/scripts/sharepoint.mjs edit-link --path "Report.docx"
Supported Office formats
The read command extracts text content from:
.docx→ full text extraction via mammoth.xlsx→ sheet names + cell data via exceljs.pptx→ slide text extraction via jszip.pdf→ text extraction via pdf-parse.txt/.md→ raw content
Output is plain text suitable for AI processing (summarization, reformatting, action item extraction).
Dependencies
@azure/identity— certificate-based Azure AD authentication@microsoft/microsoft-graph-client— Microsoft Graph API clientmammoth— Word document text extractionexceljs— Excel spreadsheet parsingjszip— PowerPoint XML extractionpdf-parse— PDF text extractioncommander— CLI frameworkdotenv— environment variable loading
Security
- Certificate auth only (no client secrets, no passwords)
Sites.Selectedpermission (access limited to one SharePoint site)- Path traversal prevention:
../is rejected - Delete requires explicit
--confirmflag - No tokens or secrets printed to stdout
- File size limit: configurable max (default 50MB)
Full setup guide
For complete setup from scratch (Entra app, certificate, Sites.Selected, Key Vault): See the GitHub repository README.
Author
Abdelkrim BOUJRAF — ALT-F1 SRL, Brussels 🇧🇪 X: @altf1be
Related Skills
openclaw/mcdonalds-skill
tools
VerifiedTrustedCommunity
Use when the user wants to connect to, test, or use the McDonalds service at mcp.mcd.cn, including checking authentication, probing MCP endpoints, listing tools, or calling McDonalds MCP tools through a reusable local CLI.
3,962SKILL.mdUpdated Apr 10, 2026
openclaw/scrapebadger
development
VerifiedTrustedCommunity
Web scraping platform — Twitter/X data, Vinted marketplace, and general web scraping API
3,962SKILL.mdUpdated Apr 10, 2026
openclaw/slowmist-security-cc
development
VerifiedTrustedCommunity
SlowMist AI Agent Security Review — comprehensive security framework for skills, repositories, URLs, on-chain addresses, and products (Claude Code version)
3,962SKILL.mdUpdated Apr 10, 2026
openclaw/humanizer-cn
data-ai
VerifiedTrustedCommunity
去除中文文本中的 AI 写作痕迹，使其读起来自然。基于维基百科 AI 写作特征指南，检测 24 种 AI 模式。触发词：humanizer-cn、去除 AI 痕迹、去除 AI 写作痕迹、中文文本人性化。
3,962SKILL.mdUpdated Apr 10, 2026