AI agent for local businesses to automate appointment scheduling, reminders, cancellations, and calendar integration.

This skill's code appears to do what it says (a simple, local CLI appointment helper) and does not request secrets or perform network I/O. Before installing, consider: 1) Verify the source — the package has no homepage and the publisher ID is unknown. 2) Confirm the metadata mismatch: registry said 'instruction-only' but SKILL.md and files include Node and code; treat this as a packaging inconsistency and prefer installing from a trusted source. 3) Run the code in an isolated/test environment first (or inspect the files locally) to confirm there are no hidden network calls. 4) If you plan to use real customer data (names/phone numbers), add proper storage and privacy controls — the current implementation only keeps data in-memory and does not provide persistence or secure handling.

Type: OpenClaw Skill Name: local-business-appointment-agent Version: 1.0.0 The skill bundle is benign. The `SKILL.md` provides standard installation and execution instructions for a Node.js application, with no evidence of prompt injection attempts or malicious commands. The `index.js` code implements a simple command-line appointment agent using in-memory storage and Node.js's built-in `readline` module. It lacks external dependencies, network calls, file system operations, or shell command executions, thus presenting no capabilities for data exfiltration, unauthorized execution, or persistence. While input validation is minimal, this is a functional vulnerability rather than an indicator of malicious intent, especially given the in-memory data storage.