Outlook Calendar

What the source does

• FilesystemNone observedNo reads or writes in the source
• NetworkNone observedNo outbound calls in the source
• ShellNone observedNo commands run in the source
• DependenciesPinnedNothing floats
• SecretsNone foundNo keys in source

Five audit layers

Gates applied: no behavioural pass.

assistant/CLAUDE.md

assistant/src/approvals/CLAUDE.md

assistant/src/notifications/CLAUDE.md

assistant/src/runtime/CLAUDE.md

gateway/CLAUDE.md

Audit 0.4.1 · source sha 19bc86343b63 · 14 Oct 2026Report an issue or request a re-scan

• Publishervellum-ai GitHub organizationOwner of the repository this skill is read from
• Source foldervellum-ai/vellum-assistant/skills/outlook-calendarThe exact folder we audited
• LicenceMITAs the repository states it
• Commit pinned for this verdict19bc86343b63A new audit runs when the source changes
• Repository statusNot archivedLast push 1 day ago
• Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

Its description: View Outlook Calendar events for any day, create and manage events, and check availability

---
name: outlook-calendar
description: View Outlook Calendar events for any day, create and manage events, and check availability
compatibility: "Designed for Vellum personal assistants"
metadata:
  icon: assets/icon.svg
  emoji: "📅"
  vellum:
    category: "calendar"
    display-name: "Outlook Calendar"
    user-invocable: true
    activation-hints:
      - "plan my day or my week"
      - "what does my day look like"
      - "check my availability, find open time slots, when am I free"
---

## Script Reference

All operations use a single CLI script that returns JSON:

- **Success**: `{ "ok": true, "data": ... }`
- **Failure**: `{ "ok": false, "error": "..." }`

| Script                   | Subcommand     | Description                                                    |
| ------------------------ | -------------- | -------------------------------------------------------------- |
| `scripts/outlook-cal.ts` | `list`         | List events within a date range (supports OData `$filter`)     |
| `scripts/outlook-cal.ts` | `get`          | Get full details of a specific event                           |
| `scripts/outlook-cal.ts` | `create`       | Create a new event (**requires user confirmation**)            |
| `scripts/outlook-cal.ts` | `availability` | Check free/busy times across calendars                         |
| `scripts/outlook-cal.ts` | `rsvp`         | Respond to an event invitation (accepted, declined, tentative) |

## Usage Examples

```bash
# List events in a date range
bun scripts/outlook-cal.ts list --start-date-time "2024-01-15T00:00:00Z" --end-date-time "2024-01-22T00:00:00Z"

# List events with an OData filter
bun scripts/outlook-cal.ts list --filter "subject eq 'Team Meeting'"

# Get full details of a specific event
bun scripts/outlook-cal.ts get --event-id "AAMkAD..."

# Create a new event (gates on assistant ui confirm)
bun scripts/outlook-cal.ts create --subject "Team Meeting" --start "2024-01-15T09:00:00-05:00" --end "2024-01-15T10:00:00-05:00" --timezone "America/New_York"

# Check availability for a day
bun scripts/outlook-cal.ts availability --start "2024-01-15T00:00:00Z" --end "2024-01-15T23:59:59Z"

# RSVP to an event invitation
bun scripts/outlook-cal.ts rsvp --event-id "AAMkAD..." --response accepted

# Target a specific connected account (see "Multiple Accounts" below)
bun scripts/outlook-cal.ts list --start-date-time "2024-01-15T00:00:00Z" --end-date-time "2024-01-22T00:00:00Z" --account "[email protected]"
```

Every subcommand accepts `--account <email>` to select which connected Outlook/Microsoft account the request runs against. When omitted, the request runs against a single account chosen automatically — safe only when exactly one Outlook account is connected. Each JSON envelope echoes the queried account in an `account` field when it is reported by the OAuth layer, so an empty result is self-describing (e.g. `No events found in the specified time range for [email protected].`).

## Connection Setup

1. **Check connection health first.** Run `assistant oauth status outlook`. This checks whether the user's Outlook/Microsoft account is connected and the token is valid. Outlook Calendar shares the same OAuth connection as Outlook email — if the user already connected Outlook email, calendar access is included.
   - **If the status output shows more than one active connection, you MUST pass `--account <email>` on every `scripts/outlook-cal.ts` invocation**, matching the calendar the user is asking about. When the user references a calendar by name or company (e.g. "my Acme calendar"), map it to the connected account email before querying. **Omitting `--account` with multiple connections silently queries one arbitrary account** — an empty or partial result then looks like a genuinely free calendar when it is really the wrong account. Confirm the `account` field in each response matches the account you intended.
2. **If no connection is found or the status check fails:** Load the `vellum-oauth-integrations` skill. The skill will evaluate whether managed or your-own mode is appropriate and guide the user accordingly.

## Scheduling Playbook

When the user wants to schedule something:

1. **Always check availability first** before proposing times. Use `bun scripts/outlook-cal.ts availability` to find free slots.
2. Propose 2-3 available time options to the user.
3. Once the user picks a time, create the event with `bun scripts/outlook-cal.ts create`.
4. If adding other attendees, mention that they'll receive an invitation email.

## Date & Time Handling

- Use ISO 8601 format for dates and times (e.g., `2024-01-15T09:00:00-05:00`).
- For all-day events, Outlook uses `dateTime` with an `isAllDay` flag — set the start and end as date-only values (e.g., `2024-01-15`).
- Always ask the user for their timezone if it's not already known from context or their profile.
- When listing events, display times in the user's local timezone.
- **Timezone edge case**: When `dateTime` already includes a UTC offset (e.g., `2024-01-15T09:00:00-05:00`), do not send a separate `timeZone` parameter — the offset in the datetime string is authoritative and sending both can cause conflicts.

## Confidence & Safety

Create and RSVP are **medium-risk** operations:

- **Create**: The `create` subcommand gates on `assistant ui confirm` — it presents a confirmation dialog to the user and only proceeds if approved. Pass `--skip-confirm` when the user has already given explicit confirmation in the conversation.
- **RSVP**: The `rsvp` subcommand gates on `assistant ui confirm` — it presents a confirmation dialog showing the event, current status, and new response. Pass `--skip-confirm` when the user has already given explicit confirmation in the conversation.

## Error Recovery

When a calendar script fails with a token or authorization error:

1. **Try to reconnect silently.** Run `assistant oauth ping outlook`. This often resolves expired tokens automatically.
2. **If reconnection fails, g

Excerpt, first 6,001 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

git clone https://github.com/vellum-ai/vellum-assistant
git -C vellum-assistant checkout 19bc86343b63

Works in

1. 2026-10-14
   ✓SAFE B 89 / 100

   first audit · source 19bc86343b63

Questions about Outlook Calendar

• github.com/vellum-ai/vellum-assistant/tree/main/skills/outlook-c — the audited source at commit 19bc86343b63 and every finding aboveObserved · 14 Oct 2026

Spotted something wrong? Report a correction · Methodology