功能描述

Generic appointment booking and management system for service businesses. Booking intake, confirmation, automated reminders (24h, 2h), no-show followup, and...

使用说明 (SKILL.md)

Appointment Booking System

Name: Appointment Booking System
Author: mhmalvi

A complete appointment booking and management system for service businesses. Handles booking intake, confirmation emails, automated reminders, no-show detection, and daily schedule reports.

Problem

Service businesses (salons, clinics, consultants, studios) lose revenue from missed appointments, no-shows, and scheduling chaos. Booking platforms charge $30-100+/month and often lack customization. Manual reminders are unreliable.

This system provides self-hosted booking management with zero monthly fees.

What It Does

Booking Intake — Webhook API receives bookings, validates fields, generates booking ID, stores in Sheets
Confirmation — Sends confirmation email to client and notification to staff immediately
Smart Reminders — Sends 24-hour and 2-hour reminders automatically
No-Show Followup — Detects missed appointments and sends rescheduling email
Daily Schedule — Morning email with today's and tomorrow's appointments plus weekly stats

Included Workflows

#	File	Purpose
01	`01-booking-intake.json`	Webhook → validate → store → confirm client → notify staff
02	`02-booking-confirmation.json`	Update booking status (confirm/cancel) via webhook
03	`03-reminder-engine.json`	Hourly check → send 24h and 2h reminders
04	`04-noshow-followup.json`	Check past appointments → detect no-shows → followup email
05	`05-daily-schedule.json`	Morning report with today's schedule and weekly stats

Architecture

Client books online (form/API)
    |
    v
Workflow 01: Booking Intake
    +-> Validate required fields
    +-> Generate booking ID
    +-> Save to Google Sheets
    +-> Email confirmation to client
    +-> Email notification to staff
    +-> Return booking ID

Status update (confirm/cancel):
    |
    v
Workflow 02: Booking Confirmation
    +-> Update status in Sheets

Hourly:
    |
    v
Workflow 03: Reminder Engine
    +-> Read confirmed appointments
    +-> Check: is appointment in 24h? -> send reminder
    +-> Check: is appointment in 2h? -> send reminder
    +-> Mark reminders as sent in Sheets

Every 2 hours:
    |
    v
Workflow 04: No-Show Followup
    +-> Check past appointments (1-48h ago)
    +-> IF no showed_up status -> mark as no-show
    +-> Send rescheduling email

Daily at 7 AM:
    |
    v
Workflow 05: Daily Schedule
    +-> Build today's and tomorrow's schedule tables
    +-> Calculate weekly stats (completed, no-shows, cancelled)
    +-> Email to staff

Required n8n Credentials

Credential Type	Used For	Placeholder in JSON
Google Sheets OAuth2	Appointment storage	`YOUR_GOOGLE_SHEETS_CREDENTIAL_ID`
SMTP	Confirmations, reminders, reports	`YOUR_SMTP_CREDENTIAL_ID`

Environment Variables

# Business Details (used in client-facing emails)
BUSINESS_NAME=Your Business Name
BUSINESS_PHONE=+1234567890
[email protected]

Note: The Google Sheet ID is configured as a YOUR_BOOKING_SHEET_ID placeholder in the workflow JSON files (not an environment variable). Replace it directly in n8n after import.

Configuration Placeholders

Placeholder	Description
`YOUR_BOOKING_SHEET_ID`	Google Sheet ID for appointments
`YOUR_GOOGLE_SHEETS_CREDENTIAL_ID`	n8n Google Sheets credential ID
`YOUR_SMTP_CREDENTIAL_ID`	n8n SMTP credential ID
`YOUR_NOTIFICATION_EMAIL`	Staff email for schedule reports

Google Sheets Schema (Appointments)

Column	Type	Description
booking_id	text	Unique booking ID (auto-generated)
name	text	Client full name
email	text	Client email
phone	text	Client phone
service	text	Service type (e.g., haircut, consultation)
date	date	Appointment date (YYYY-MM-DD)
time	text	Appointment time (HH:MM)
notes	text	Client notes
status	text	confirmed / cancelled / no-show / completed
showed_up	boolean	Whether client attended
reminder_24h	boolean	24h reminder sent
reminder_2h	boolean	2h reminder sent
created_at	datetime	Booking creation timestamp

Quick Start

1. Prerequisites

n8n v2.4+ (self-hosted)
Google Sheets OAuth2 credentials
SMTP email credentials

2. Create Appointments Sheet

Create a Google Sheet with the columns above. Name the tab "Appointments".

3. Import & Configure

Import all 5 JSON files into n8n. Replace all YOUR_* placeholders and set environment variables.

4. Test Booking

curl -X POST https://your-n8n.com/webhook/booking/new \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Jane Smith",
    "email": "[email protected]",
    "phone": "+1234567890",
    "service": "Consultation",
    "date": "2026-03-10",
    "time": "14:00",
    "notes": "First visit"
  }'

Use Cases

Hair salons — Booking, reminders, and no-show tracking for stylists
Medical/dental clinics — Patient appointment management
Consultants — Strategy call scheduling with automated reminders
Fitness studios — Class and personal training bookings
Auto repair shops — Service appointment scheduling

Requirements

n8n v2.4+ (self-hosted or cloud)
Google Sheets OAuth2 credentials
SMTP email credentials

安全使用建议

This package appears to implement the booking system it describes, but check the following before installing: 1) Provenance: confirm the author/owner — registry metadata (ownerId and version) doesn't match _meta.json and SKILL.md. If provenance matters, ask the publisher which is authoritative. 2) n8n credentials & scopes: the workflows require Google Sheets OAuth2 and SMTP credentials. Grant only the minimum Google scopes (Sheets access only) and use an SMTP account dedicated to these notifications. 3) Webhook security: the included webhooks (booking/new and booking/confirm) are public endpoints by default. Protect them with a secret token, IP restrictions, or n8n authentication and validate incoming requests. Without protection, attackers could spam bookings or trigger mass emails. 4) Sheet ID handling: the Google Sheet ID is embedded as a placeholder in the JSON files. After import, ensure the sheet is in a project/account you control and review the sheet's sharing settings — do not use a sheet that is broadly shared. 5) Test in staging: import into a staging n8n instance, use test credentials, and verify logic (timezones, date parsing, duplicate handling) and that no unexpected network calls occur. 6) Data protection & compliance: appointments contain personal data (names, emails, phone numbers). Confirm retention, access controls, and compliance obligations (e.g., HIPAA, GDPR) before using in production. If you cannot verify the owner or the provenance, treat it as higher risk and prefer a well-known or self-authored alternative.

功能分析

Type: OpenClaw Skill Name: appointment-booking-system Version: 1.0.1 The skill's core functionality is benign, providing an appointment booking system. However, the n8n workflows, particularly in `workflows/01-booking-intake.json` and `workflows/05-daily-schedule.json`, embed user-provided input (e.g., name, service, notes) directly into HTML email bodies without proper sanitization. This creates a Cross-Site Scripting (XSS) vulnerability, allowing an attacker to inject malicious HTML or JavaScript into booking details, which would then execute in the email clients of recipients (clients receiving confirmations/reminders, or staff receiving daily reports). This is a significant vulnerability that could lead to phishing or other client-side attacks, classifying the skill as suspicious due to the potential for exploitation.

能力评估

ℹ Purpose & Capability

Workflows, SKILL.md, and JSON files implement a coherent appointment booking system (webhook intake, Google Sheets storage, SMTP emails, reminders, no-show handling, daily reports). However there are metadata inconsistencies: registry-level ownerId and version differ from _meta.json and SKILL.md (registry lists ownerId 'kn75ky42...' and version 1.0.1, while _meta.json and SKILL.md reference 'mhmalvi' and version 1.2.0). This mismatch is not inherently malicious but reduces provenance confidence and should be verified.

ℹ Instruction Scope

SKILL.md and included workflows limit actions to n8n operations (webhooks, Google Sheets reads/writes, SMTP sending). They do not instruct the agent to read local files or unrelated env vars. Operational risk: workflows create public webhook endpoints (booking/new, booking/confirm) with no guidance in SKILL.md about authentication or request validation beyond simple field checks. You should ensure webhooks are protected (tokens, IP allowlist, or firewall) before exposing publicly.

✓ Install Mechanism

No install spec or external downloads — instruction-only with n8n workflow JSON files included. No code is written to disk by an installer, which is low-risk from an install-mechanism perspective.

ℹ Credentials

Declared required env vars (BUSINESS_NAME, BUSINESS_PHONE, STAFF_EMAIL) are reasonable for email content. The SKILL.md metadata also requires n8n credentials (Google Sheets OAuth2 and SMTP) which are necessary for the described functionality but were not listed in the top-level registry 'primary credential' block — an omission in registry metadata. Verify you provide only the minimum OAuth scopes needed for Google Sheets and use an SMTP account dedicated for transactional emails. The workflows embed the Google Sheet ID as a placeholder in JSON (not an env var) — consider managing that value securely.

✓ Persistence & Privilege

always:false and normal model invocation settings. The skill does not request persistent platform-level privileges or modify other skills. Its scheduled workflows will run within n8n as expected; ensure you review n8n's execution permissions and who can import/activate workflows.

版本历史

v1.0.1

Fix: declare all env vars used in workflows in requires.env metadata for security scan compliance

v1.0.0

**Appointment Booking System v1.2.0 – Major Update** - Now includes 5 production-ready n8n workflows for complete appointment lifecycle automation. - Google Sheets backend enables customizable, zero-monthly-fee appointment management. - Automated emails for booking confirmation, staff notification, 24h/2h reminders, daily reports, and no-show followup. - Flexible integration through environment variables and n8n credentials for Google Sheets and SMTP. - Designed for salons, clinics, consultants, studios, and service businesses needing reliable scheduling and automation.

元数据

Slug appointment-booking-system

版本 1.0.1

许可证 —

累计安装 1

当前安装数 1

历史版本数 2

常见问题