Mental Health Booking

Book same-day psychiatric and mental health telehealth appointments through conversation — no forms, no portals. Covers ADHD, anxiety, depression, insomnia,...

This skill appears to implement booking by calling https://rx.helloklarity.com and will ask users for sensitive personal and health information (name, DOB, email, phone, insurance IDs) and then POST that data to an external API. Before installing, consider: (1) Do you trust the external domain (rx.helloklarity.com)? Verify vendor identity and privacy/HIPAA handling. (2) The script accepts an undocumented BOOKING_API_URL environment override — ensure runtime environments cannot set this to a malicious endpoint (lock/whitelist or remove override). (3) The SKILL.md claims multiple partner platforms but only Klarity is implemented — ask the author to clarify. (4) Ensure your agent/runtime will not log or persist PHI in telemetry or debug logs and that you have user consent to transmit sensitive data. (5) Prefer testing in 'dry-run' mode (book-dry) and review network traffic from a safe test account before using with real patient data. If you need help vetting the remote service or restricting BOOKING_API_URL, get a security/IT review first.

Type: OpenClaw Skill Name: mental-health-booking Version: 1.0.0 The skill facilitates mental health appointment bookings by collecting sensitive PII (Name, DOB, Email, and Insurance IDs) and transmitting it to a third-party API (rx.helloklarity.com). While the behavior is aligned with the stated purpose and includes safety features like a crisis check in SKILL.md, the script 'scripts/booking-api.sh' contains a potential command injection vulnerability where the 'carrier' argument is unsafely passed into a python3 execution string. This flaw could allow a malicious user to execute arbitrary code on the agent's host system via the insurance carrier input field.