Api Odontosoft

Gestiona turnos odontológicos en Odontosoft. Usar cuando el usuario quiera consultar doctores disponibles, ver turnos libres de un odontólogo, buscar un paci...

Security Scan

The skill's code, manifest, and runtime instructions are consistent with its stated purpose (managing Odontosoft appointments) and only require a base URL and API token for the API; nothing appears disproportionate or unexpected.

Purpose & Capability

Name/description match the implemented functions: listing doctors, checking availability, searching patients, and scheduling. The code exclusively calls the configured baseUrl and uses a bearer token (apiKey) — these are appropriate for an API integration.

Instruction Scope

SKILL.md and README limit actions to calling the Odontosoft REST API and describe a clear flow for booking. The runtime code only performs HTTP requests to the configured API and does not read files, other env vars, or unrelated system state.

Install Mechanism

Instruction-only skill with no install spec and no external downloads; code is small and included in the package. Low install risk.

Credentials

The skill requires only a base URL and an API token (declared in manifest as baseUrl and apiKey) which is proportionate. Minor inconsistency: SKILL.md/README reference environment variable names ODONTOSOFT_BASE_URL / ODONTOSOFT_TOKEN, while the manifest expects config keys baseUrl and apiKey—this is likely just naming but the user should map their secret names accordingly.

Persistence & Privilege

always is false and the skill does not request system/config path access or alter other skills. It has normal, limited network permission scoped to the API host declared in the manifest.

Assessment

This skill appears to do exactly what it says: make HTTP requests to the configured Odontosoft API using a bearer token. Before installing: (1) confirm you will supply the correct base URL and token and that they map to the manifest config (baseUrl, apiKey) or the env vars you use (README mentions ODONTOSOFT_BASE_URL/ODONTOSOFT_TOKEN); (2) verify the API host (example uses api.odontosoft.com.py) is the legitimate service and uses HTTPS; (3) treat the token as sensitive — only provide it to trusted skills and rotate it if you suspect misuse; (4) consider privacy/regulatory requirements for patient data since this skill sends personal health data to the configured API. If you need greater assurance, inspect network logs or test with a non-production token and endpoint first.

Odontosoft

Conecta con la API REST de Odontosoft usando las herramientas definidas en manifest.json.

Herramientas disponibles

• get_doctores — Lista los odontólogos activos de la clínica
• get_turnos_disponibles — Horarios libres de un doctor en una fecha (doctor_id, fecha)
• buscar_paciente — Busca paciente por número de documento (documento)
• agendar_turno — Crea un turno (paciente_id, doctor_id, fecha, hora, motivo)

Flujo recomendado para agendar

1. get_doctores → elegir doctor
2. get_turnos_disponibles → confirmar slot libre
3. buscar_paciente → obtener paciente_id
4. Confirmar datos con el usuario
5. agendar_turno