appointment-scheduler

AdvisoryAudited by Static analysis on May 10, 2026.

Overview

Detected: suspicious.dangerous_exec

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ConcernHigh Confidence

ASI05: Unexpected Code Execution

What this means

If a crafted booking ID reaches this path, canceling with waitlist notification could run unintended shell commands under the user’s account.

Why it was flagged

bookingId comes from command-line arguments and is inserted into a shell command string without validation or an argument array.

Skill content

const output = execSync(`node "${scriptPath}" notify --booking-id ${bookingId}`, {

Recommendation

Replace execSync shell strings with execFile/spawn using an argument array, or import waitlist logic directly; also validate booking IDs with a strict pattern such as hexadecimal-only.

ConcernHigh Confidence

ASI02: Tool Misuse and Exploitation

What this means

A malformed date containing path traversal sequences could read or write JSON files outside the intended appointments directory, potentially corrupting workspace configuration or data.

Why it was flagged

The user-supplied date argument is used directly in a filesystem path; similar date-based path construction appears in booking/schedule scripts.

Skill content

const filePath = path.join(DATA_DIR, `${date}.json`);

Recommendation

Require dates to match YYYY-MM-DD, reject path separators and '..', and after resolving the path verify it remains inside the intended data directory.

NoteHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

Calendar sync can add customer appointment details to the user’s Google Calendar and the stored token may grant broad calendar access.

Why it was flagged

The Google Calendar integration uses local OAuth credential/token files and requests broad Calendar API access.

Skill content

const CREDENTIALS_PATH = path.join(process.env.HOME, '.secrets', 'google-calendar-credentials.json'); ... scope: ['https://www.googleapis.com/auth/calendar']

Recommendation

Use a dedicated calendar if possible, protect the ~/.secrets token files, and consider a narrower Google Calendar scope if the implementation only needs event creation.

NoteHigh Confidence

ASI06: Memory and Context Poisoning

What this means

Customer names, phone numbers, emails, attendance history, and reminder status may remain in local workspace files across sessions.

Why it was flagged

The skill persistently stores customer appointments, contacts, no-show history, flagged-customer records, and reminder logs.

Skill content

data/appointments/ ... bookings/ ... waitlist/ ... noshow/history.json ... flagged-customers.json ... reminders/sent.json

Recommendation

Treat the workspace data as sensitive, set retention/deletion practices, and avoid storing more customer details than the business needs.

NoteHigh Confidence

ASI10: Rogue Agents

What this means

If the user installs the cron entries, the skill’s reminder or sync scripts will keep running on a schedule until removed.

Why it was flagged

The documentation suggests user-configured cron jobs for recurring reminders and calendar sync.

Skill content

0 9 * * * cd /Users/mupeng/.openclaw/workspace/skills/appointment-scheduler/scripts && node send-reminders.js --type day-before

Recommendation

Only add cron jobs intentionally, review what messages or calendar updates they trigger, and remove the cron entries when the skill is no longer used.

NoteHigh Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing npm packages is expected for these Node scripts, but it pulls third-party code into the local environment.

Why it was flagged

The skill is listed as having no install spec, but its setup guide asks the user to install npm dependencies; package.json and package-lock.json are present.

Skill content

cd /Users/mupeng/.openclaw/workspace/skills/appointment-scheduler/scripts
npm install

Recommendation

Run npm install only from the reviewed scripts directory, keep the lockfile, and review dependency updates before accepting them.

Findings (1)

critical

suspicious.dangerous_exec

Location: scripts/cancel-booking.js:58
Finding: Shell command execution detected (child_process).