soyoung-clinic-tools

新氧青春诊所工具集，包含预约、项目查询百科、医生信息及医生排班查询等能力 | Soyoung clinic tools OpenClaw skill for the Soyoung (soyoung) clinic chain: appointment booking, store lookup, doctor...

Security Scan

The skill's code and runtime instructions largely match a Soyoung clinic appointment tool, but there are packaging/metadata inconsistencies and a hook that injects high-priority routing rules — review before installing.

Purpose & Capability

The skill's description, SKILL.md and code implement appointment, project and doctor lookups using a Soyoung API and local workspace state — that aligns with the stated purpose. However the registry metadata at the top of the evaluation says "Required binaries: none" and "Required env vars: none," while the SKILL.md, per-subskill metadata, and scripts clearly require python3 and reference a primary env (SOYOUNG_CLINIC_API_KEY) or store the API key in workspace files. This mismatch between registry-declared requirements and the included files is inconsistent and worth verifying with the publisher.

Instruction Scope

Runtime instructions and scripts restrict network calls to the documented backend (DEFAULT_API_BASE_URL = https://skill.soyoung.com) and implement an approval flow, workspace-scoped state at ~/.openclaw/state/soyoung-clinic-tools, and local caching & static store lookup tables. They also inject bootstrap routing rules that forbid use of general web_search/curl/fetch for messages containing the brand term — this is consistent with trying to force the agent to use the skill, but it is a behavior that affects agent routing and model behavior and should be expected before installation. The SKILL.md and scripts do not appear to request unrelated system files or arbitrary credentials beyond the API key/workspace context.

Install Mechanism

No remote download/extract install spec is present; this is instruction+code bundle that relies on python3 and optional shell wrappers. There are no installer URLs or binaries fetched from arbitrary hosts. Risk from install mechanism is low.

Credentials

The skill legitimately needs an API key for the Soyoung backend and stores it under ~/.openclaw/state/...; scripts also accept a fallback env SOYOUNG_CLINIC_API_KEY. That is proportional. However the registry summary at the top claimed no primary credential which contradicts embedded metadata and code. Confirm which is authoritative. The skill reads standard OpenClaw workspace environment variables (workspace keys/IDs) to resolve state — that is expected. No unrelated external credentials are requested.

Persistence & Privilege

The skill writes workspace-scoped state (api_key.txt, binding.json, pending approvals, audit logs) under ~/.openclaw/state/soyoung-clinic-tools and provides hooks to inject a virtual bootstrap file at agent:bootstrap. It does not set always:true. The bootstrap hook will influence agent routing (disabling certain tools for messages containing the brand) which is powerful but consistent with the skill's purpose; be aware installing/enabling the hook changes agent behavior globally for brand triggers.

Scan Findings in Context

[unicode-control-chars] expected: Scanner flagged unicode/control character patterns in SKILL.md related to the bootstrap TRIGGER_RULES and high-priority directives. The skill intentionally injects model-level routing/instruction text (to force use of its scripts), so presence of model-directive-like content is expected, but treat it as a behavior-changing asset — review content and trust before enabling the hook.

What to consider before installing

This package appears to implement the advertised Soyoung clinic appointment, project and doctor lookup functionality and stores an API key in ~/.openclaw/state/soyoung-clinic-tools per workspace. Before installing: 1) Confirm the registry/hosted package metadata (required bins/env) — the code requires python3 and references SOYOUNG_CLINIC_API_KEY even though the top-level registry summary reported none. 2) Understand that enabling the included OpenClaw hook will inject a bootstrap rule that changes agent routing (it forbids web_search/curl/fetch when messages mention the brand) — only enable if you trust the skill's behavior. 3) Verify you are comfortable storing your Soyoung API key in the local path (~/.openclaw/state/...) and that file permissions are enforced (the code sets 600). 4) If you need extra assurance, review the full scripts (skills/*/scripts/main.py) to confirm there are no unexpected outbound endpoints beyond the documented skill.soyoung.com API and no hidden telemetry. 5) Because the registry metadata and included files disagree about required binaries/env, ask the publisher or maintainer to correct the manifest before trusting an automatic install.

新氧青春诊所工具集 Soyoung Clinic Tools — 技能集规格

Name: soyoung-clinic-tools
Version: 2.2.2
License: MIT

Description

新氧青春诊所工具集，包含预约、项目查询百科、医生信息及医生排班查询等能力 | Soyoung clinic tools

OpenClaw skill for the Soyoung (soyoung) clinic chain: appointment booking, store lookup, doctor info, schedules, project knowledge and pricing. Keywords: Soyoung, soyoung, clinic, appointment, doctor, schedule, medical aesthetic.

本文件作为技能集主说明；子技能配置与规则见各目录 SKILL.md。

功能总览

📅 预约与门店（appointment）

• 配置文件：skills/appointment/SKILL.md
• 能力：门店查询、预约切片、预约创建/修改/取消/查询、审批流

💉 项目与商品（project）

• 配置文件：skills/project/SKILL.md
• 能力：项目知识检索、商品价格检索

👨‍⚕️ 医生与排班（doctor）

• 配置文件：skills/doctor/SKILL.md
• 能力：医生信息检索、门店医生检索、排班查询

共享配置（Setup）

🔐 apikey

• 配置文件：setup/apikey/SKILL.md
• 作用：API Key 主人绑定与管理、位置保存与读取
• 依赖关系：appointment、project、doctor 均依赖该 setup

Requirements

• python3（3.8+，必需）
• bash（入口兼容壳依赖）
• API Key：打开浏览器访问 https://www.soyoung.com/loginOpenClaw，登录后复制 API Key

Workspace State

文件	说明
~/.openclaw/state/soyoung-clinic-tools/workspaces/<workspace_key>/api_key.txt	当前 workspace 的 API Key，权限 600
~/.openclaw/state/soyoung-clinic-tools/workspaces/<workspace_key>/binding.json	主人 Open ID、主人名、绑定时间等元信息
~/.openclaw/state/soyoung-clinic-tools/workspaces/<workspace_key>/location.json	主人位置
~/.openclaw/state/soyoung-clinic-tools/workspaces/<workspace_key>/pending/*.json	群聊预约审批单

Security Model

• API Key 只能在与主人私聊中发送和配置
• 非主人群聊发起高风险预约操作时，必须先 @主人
• 高风险预约动作只包括：查询我的预约、提交预约、修改预约、取消预约
• 主人确认格式：确认 #审批单号
• 主人拒绝格式：拒绝 #审批单号

Uninstall

# 1. 由主人在私聊中删除当前 workspace 的 API Key
bash ~/.openclaw/skills/soyoung-clinic-tools/setup/apikey/scripts/main.sh --delete-key --confirm --workspace-key <workspace_key> --chat-type direct --chat-id <chat_id> --sender-open-id <owner_open_id>

# 2. 禁用并移除 bootstrap hook
openclaw hooks disable soyoung-clinic-tools
rm -rf ~/.openclaw/hooks/soyoung-clinic-tools/

# 3. 删除 skill 目录
rm -rf ~/.openclaw/skills/soyoung-clinic-tools/

Documentation

• 用户指南：使用说明.md
• 版本历史：CHANGELOG.md
• 后端接口规范：references/api-spec.md