Beautsgo Booking

What to consider before installing/use: - Confirm the booking API: the code posts user phone/contact info to https://api.yestokr.com/api/Appointment/saveFromSkill. Ask the author to confirm that this endpoint is the official BeautsGO booking API (domain mismatch with beautsgo.com is notable). Do not provide real phone numbers until you trust the endpoint. - Consent & confirmation: ensure the agent will explicitly ask for and record user consent before sending any personal contact info. The skill is designed to send PII (phone numbers) as part of booking — that is necessary for the feature but requires clear consent. - Prompt‑injection artefact: SKILL.md contained unicode control characters (a prompt‑injection signal). This could hide instructions or manipulate the agent. Request a cleaned SKILL.md or inspect the file to remove hidden characters. - Review bundled scripts before running locally: repository includes scripts (sync-to-openclaw.sh, import scripts). None are auto-run by the platform, but if you run npm scripts locally, inspect them first. - Dependency & runtime: the skill expects Node.js (>=16) and npm packages (pinyin-pro). If you run it locally, run npm install only after reviewing package.json/package-lock and ensure you trust the npm packages. - Test safely: try queries that do not include real contact info to exercise 'view' and 'open' flows. Only test the booking POST with a disposable phone number after you confirm the endpoint's legitimacy and get user consent. If you want, I can: - List the exact places in api/skill.js where POST is invoked so you can verify call/consent flow, or - Produce a cleaned version of SKILL.md with nonprintable characters removed for manual review.