Cliento Booker

Register Cliento booking pages via URL, check availability, and execute actual service bookings. Use when the user asks to book a haircut, reserve a service,...

Security Scan

The skill's code, instructions, and requested resources are consistent with its stated purpose (registering Cliento pages, checking availability, and making bookings); it uses a bundled Python helper to call booking endpoints and stores state in workspace files.

Purpose & Capability

Name/description match what the skill does: the SKILL.md and scripts/cliento.py implement registering booking pages, fetching slots, reserving, and confirming bookings. Required binary (python3) is appropriate. The script targets cliento.com/web.prod.cliento.com endpoints which align with the booking purpose. The SKILL.md correctly documents that it uses reverse-engineered/undocumented endpoints (fragility risk but coherent).

Instruction Scope

Runtime instructions stay within the booking domain: they direct use of scripts/cliento.py to fetch HTML and call specific API endpoints, manage a workspace stores.json, and read/write (with consent) USER.md contact details. The skill explicitly requires asking the user before finalizing live bookings and recommends using a separate calendar tool for cross-referencing.

Install Mechanism

No install spec; the skill is instruction-only with a small included Python script. Nothing is downloaded from remote URLs or installed to system locations. Risk from install mechanism is low.

Credentials

The skill requests no environment variables or external credentials (none declared). It does read and persist workspace files: ./ .cliento/stores.json and USER.md (the latter may contain personal contact info). The SKILL.md does not declare these config paths in registry metadata, but they are workspace-local and related to the skill’s purpose; users should be aware this will access and may write personal contact info if the user consents.

Persistence & Privilege

always is false and model invocation is allowed (default). The skill can be invoked autonomously by the agent; because it performs live network actions that can temporarily reserve or finalize bookings, ensure the agent enforces the SKILL.md requirement to always ask the user before confirming bookings. There is no request to modify other skills or system-wide settings.

Assessment

This skill appears to do what it says, but review and consider the following before installing: - It will read and write workspace files: ./ .cliento/stores.json and USER.md. Make sure USER.md does not contain secrets you don't want the skill to access; the skill may store personal contact details if you agree. - The helper script calls cliento.com / web.prod.cliento.com endpoints (reverse-engineered APIs); functionality may break and you should verify these endpoints are legitimate for your use. - Because the agent may be allowed to invoke the skill autonomously, ensure policies or prompts prevent automatic finalization of bookings without explicit, per-booking user confirmation. - If you want extra safety, run the skill in a constrained environment (sandbox or workspace copy) and inspect the included scripts yourself before granting it access to your primary workspace files.

Cliento Booker Skill

You manage a persistent list of Cliento booking pages, check their availability, and execute actual bookings for the user. You maintain state using files located relative to your workspace: ./.cliento/stores.json.

Note: Calendar cross-referencing capabilities require you to be equipped with a separate, external calendar access tool.

Core Workflow

You execute up to 6 core actions depending on the user's request. Crucially: you must use the scripts/cliento.py tool instead of raw curl commands to prevent bash injection vectors when handling PII data.

Handling the Empty State

If ./.cliento/stores.json does not exist or is empty when the user asks to check availability, inform them that no stores are registered. Ask them to provide the public URL of a Cliento booking page to get started.

Action 1: Registering a Store

When the user provides a Cliento URL to register:

1. Verify the URL is safe, then fetch the raw HTML by executing python3 scripts/cliento.py register <URL>.
2. Parse the embedded Next.js JSON (inside <script id="__NEXT_DATA__" type="application/json">) to extract the Company ID, available services, and barbers.
3. Present the list to the user and ask them to select a service, a barber (or "Any"), and provide a memorable alias.
4. Save the new store object to ./.cliento/stores.json.

Action 2 & 3: Checking Availability

When the user asks for an appointment:

1. Read ./.cliento/stores.json to extract the saved store parameters.
2. Determine the target date range.
3. Fetch the available slots via the script: python3 scripts/cliento.py slots <company_id> <service_id> <from_date> <to_date> [resource_id].
4. Calendar Cross-Reference: If you have access to a calendar tool, pull the user's schedule. Filter out Cliento slots that overlap with busy blocks, factoring in travel time requested by the user.
5. Present the available time slots to the user.

Action 4: Reserving a Slot

To reserve a time slot (temporarily held for ~5 minutes):

1. Execute the reservation POST request using the slotKey via the script: python3 scripts/cliento.py reserve <company_id> <slot_key>.
2. Parse the returned cbUuid. Present the reservation details (expiration time, service, price) to the user.
3. Inform the user this is only a temporary hold and proceed immediately to Action 5.

Action 5: User Booking Preferences

Before finalizing, verify the user's contact details by checking the workspace USER.md file.

1. If USER.md does not contain them, ask the user for their First Name, Last Name, Phone Number (international format), and Email.
2. Ask if they want to permanently save these new details in USER.md for future use. Only save them if the user explicitly agrees.
3. Ask if the user wants to include an optional note to the service provider.

Action 6: Confirming a Booking

Executing this action will finalize a live booking. Always ask the user if they are ready to proceed before doing this.

1. Execute the confirmation POST sequence to finalize the booking using the script: python3 scripts/cliento.py confirm <company_id> <cb_uuid> "<first_name>" "<last_name>" "<email>" "<phone>" "<note>" "<booked_specific_true_false>"
2. If the API returned that a Pin is required, the script output will notify you and you must ask the user for the pin, then append it to the args.
3. Inform the user when the booking is successfully complete and "emailConfirmSent": true is verified.

Stores Format Example

./.cliento/stores.json:

[
  {
    "alias": "Barber",
    "url": "https://cliento.com/business/barber-and-friends-1697/",
    "company_id": "5qdvTnEGaI1BRv42GeTMUC",
    "service_id": 33003,
    "resource_id": null
  }
]

Limitations & Disclaimer

• Slot reservation holds the time temporarily (~5 minutes).
• Fully automated booking is only supported for stores using the "NoPin" confirmation method.
• This skill interacts with undocumented, reverse-engineered API endpoints and may break at any time.