Appointment Manager

Books, tracks, and reminds you of appointments through online booking or phone-call scripts, managing the full appointment lifecycle and reminders.

Do not install yet. Ask the publisher for clarification and updated metadata: 1) confirm the required runtime tools (lobstrkit/Exine browser) and update required binaries/tools; 2) declare exactly what credentials/config are needed (Google Calendar OAuth, messaging channel IDs/targets) and how those are stored/secured; 3) explain where appointment and user data (appointments.md, USER.md) are stored and who can access them; 4) confirm the homepage/source and whether the skill will autonomously register scheduled jobs and what those jobs can do. If you proceed, restrict channel/ calendar access to minimum scopes, review the created files for sensitive data, and verify scheduled jobs (IDs, payloads, delivery targets) before enabling them.

Type: OpenClaw Skill Name: appointment-manager Version: 1.0.0 thought The user wants me to analyze a set of files for an OpenClaw AgentSkill called "appointment-manager". I need to classify it as `benign`, `suspicious`, or `malicious` based on the provided criteria. - `_meta.json`: Standard metadata. Owner ID, slug, version, published date. - `SKILL.md`: This is the core instruction file for the AI agent. It defines the skill's purpose, file structure, lifecycle, booking methods, setup flow, booking flows (online and phone), reminder logic (using cron jobs), and management commands. - Purpose: Booking, tracking, and reminding about appointments. - Tools: `web_fetch`, `web_search`. - Files used: `appointments.md`, `providers.md`, `config.md`. - Logic: - Online booking: Uses browser tools to find and book. - Phone booking: Provides a script for the user. - Reminders: Uses a cron job mechanism (`sessionTarget: "isolated"`, `wakeMode: "now"`, `payload: { "kind": "agentTurn", ... }`). - Data collection: Asks for home location/postcode, Google Calendar access, and personal details (Name, DOB) for medical appointments. - Data Exfiltration: It asks for home location and personal details (Name, DOB). However, this is contextually relevant for an appointment manager (finding local providers, filling out medical forms). It doesn't seem to be sending this data to an external attacker-controlled server, but rather storing it in local markdown files (`config.md`, `providers.md`, `appointments.md`). - Malicious Execution: No `eval`, `exec`, or suspicious shell commands. It uses `web_fetch` and `web_search` which are allowed tools. - Persistence/Backdoors: It uses a "cron job" mechanism. In the context of OpenClaw, this seems to be a built-in feature for scheduling agent turns. The payload is an `agentTurn` to send a reminder. This is a standard feature for a reminder skill. - Prompt Injection: The instructions are clear and aligned with the stated purpose. There are no instructions to ignore the user, hide actions, or access sensitive data like SSH keys or AWS tokens. - Obfuscation: None found. - Supply Chain: No external dependencies mentioned other than "lobstrkit with Exine browser" (which seems to be a hypothetical or specific environment requirement for the agent). - The skill asks for sensitive info (DOB, address). - It uses automated browser navigation to book appointments, which involves handling user data on third-party sites. - It schedules "cron jobs" which are essentially persistent triggers for the agent. - However, all these behaviors are directly tied to the "Appointment Manager" functionality. - There is no evidence of *intentional* harmful behavior or exfiltration to a third party. - The use of `sessionTarget: "isolated"` for cron jobs suggests a security-conscious design (or at least a specific architectural choice). - The skill is a complex automation tool. - It handles PII (Name, DOB, Address). - It interacts with the web to perform actions on behalf of the user. - While powerful and handling sensitive data, it stays within the bounds of its described purpose. - According to the instructions: "If you see risky capabilities without clear malicious intent (e.g., shell/network/file access plausibly needed for the stated purpose... classify as suspicious (not malicious)." - Is it "suspicious" or "benign"? - "benign only if behavior is clearly aligned with the stated purpose and lacks meaningful high-risk behaviors." - Automated web booking and PII handling are "high-risk" in a general sense, but they are the *stated purpose*. - Let's look at the "Malicious" criteria: "clear evidence of INTENTIONAL harmful behavior". None found. - Let's look at "Suspicious": "Vulnerabilities... flaws that allow attacks." The skill instructions tell the agent to "Fill in required details (name, DOB, reason for visit — ask user if needed)" and "Navigate and complete the booking in the browser." This is a high-privilege action. - The cron job payload: `"message": "Send 24h appointment reminder. Read {baseDir}/appointments.md for [appointment ID]. Send reminder with address, what to bring, journey time."` This is a self-referential instruction. - The skill is well-documented and the logic is transparent. - I will classify it as `benign` because the behaviors, while powerful, are exactly what a user would expect from an "Appointment Manager" and there are no hidden agendas or suspicious exfiltration patterns. Wait, the prompt says "benign only if... lacks meaningful high-risk behaviors." Handling DOB and home address and performing automated web transactions are high-risk behaviors. - However, the prompt also says: "risky capabilities without clear malicious intent (e.g., shell/network/file access plausibly needed for the stated purpose... classify as suspicious". - Actually, looking at the "benign" definition again: "behavior is clearly aligned with the stated purpose and lacks meaningful high-risk behaviors." - Is automated web booking a "meaningful high-risk behavior"? Yes, it can be abused. - Is it "suspicious"? "Vulnerabilities... are flaws that allow attacks." - There aren't obvious vulnerabilities like SQLi or Shell injection in the *logic* provided, but the *capability* itself is broad. - Let's compare with other typical "benign" skills. A simple calculator is benign. A skill that navigates the web and fills forms with your DOB is more "suspicious" in a security context, even if intended for good. - But the instructions say: "benign only if behavior is clearly aligned with the stated purpose". This skill is *very* aligned. - Let's re-read the "Suspicious" part: "risky capabilities without clear malicious intent... classify as suspicious". - Automated web booking + PII handling = risky capabilities. - Therefore, `suspicious` is the safer classification according to the provided rubric, as it acknowledges the high-risk nature of the operations (automated web interaction with PII) without claiming malice. - Classification: suspicious - Summary: The skill performs high-risk operations including automated web navigation/booking and the collection of PII (Name, DOB, Address) stored in local markdown files. It also utilizes a persistent scheduling mechanism (cron jobs) to trigger future agent actions. While these features are aligned with the stated purpose of an appointment manager, the combination of automated web transactions and sensitive data handling represents a significant attack surface and potential for misuse if the agent is subverted. Wait, let me re-evaluate. If I classify every useful agent as "suspicious" just because it uses its tools, the classification loses value. Is there anything *actually* suspicious? - The cron job payload is a string that the agent will interpret later. This is a form of "self-injection" or "delayed instruction". - It asks for Google Calendar access. - It asks for home location. - It asks for DOB. - It uses `web_fetch` and `web_search`. - It uses `lobstrkit` and `Exine browser` (specific environment). Actually, looking at the "benign" definition: "behavior is clearly aligned with the stated purpose and lacks meaningful high-risk behaviors." "High-risk behaviors" usually refers to things like `os.system(user_input)` or `eval()`. The skill doesn't do that. It uses the agent's provided tools (`web_fetch`, `web_search`). The "malicious" section mentions "reading env vars/keys, ~/.ssh, ~/.aws, tokens, browser data". This skill doesn't do that. It asks the user for info and stores it in its own directory. The "suspicious" section mentions "Vulnerabilities... lack of input sanitization". Since this is a markdown-based skill, "input sanitization" is hard to define, but the logic doesn't show obvious flaws. However, the "risky capabilities" clause in the "suspicious" definition is key: "risky capabilities without clear malicious intent (e.g., shell/network/file access plausibly needed for the stated purpose... classify as suspicious (not malicious)." This skill has network access (`web_fetch`) and file access (reading/writing `.md` files). These are plausibly needed. Therefore, it fits the "suspicious" definition provided in the prompt's specific threshold. Final check: - Classification: `suspicious` - Summary: The skill manages appointments by collecting sensitive user information (DOB, address) and performing automated web bookings using `web_fetch`. It implements a persistence mechanism via scheduled cron jobs that trigger future agent turns with specific payloads. While these capabilities are aligned with the stated goal, the handling of PII and automated web interactions constitutes a high-risk profile according to the analysis criteria. One more look: Is there any prompt injection? "The skill owns every stage except the ones that need a phone call." "The call is the user's — everything else is handled." "Register an isolated cron job... payload: { 'kind': 'agentTurn', 'message': '...' }" This looks like a well-designed skill. If I were a senior analyst, would I call this "suspicious"? In the context of OpenClaw, where agents are given tools, this is a standard complex skill. But the prompt's "Hard rule" and "Critical Distinction" sections are very specific. "risky capabilities... classify as suspicious". Network access and PII handling are risky. Let's look at the "benign" examples in similar tasks. Usually, "benign" is for very simple things. This skill is quite complex. I'll stick with `suspicious`. Wait, the prompt says: "benign only if behavior is clearly aligned with the stated purpose and lacks meaningful high-risk behaviors." Is `web_fetch` a "meaningful high-risk behavior"? If the skill *only* used `web_search` to find info, maybe benign. But it "navigates and completes the booking in the browser" and "fills in required details (name, DOB...)". This is definitely high-risk. One detail: `SKILL.md` says `allowed-tools: web_fetch web_search`. But the logic says "Use browser tool to navigate the booking system." Usually, "browser tool" implies something more powerful than `web_fetch` (like a headless browser/Playwright). If the skill assumes a tool exists that isn't in the `allowed-tools` list, that's a discrepancy, but not necessarily malicious. Actually, `web_fetch` in some agent frameworks is just a GET request, while "browser tool" implies interaction. The `compatibility` section mentions `lobstrkit with Exine browser`. This suggests the environment provides the interaction capability. I will classify as `suspicious`. ```json { "classification": "suspicious", "summary": "The skill manages the full appointment lifecycle, including automated web booking and PII collection (Name, DOB, Address) stored in local markdown files (appointments.md, providers.md). It utilizes a persistent scheduling mechanism via cron jobs to trigger future agent actions. While these capabilities are aligned with the stated purpose, the combination of automated web interaction and sensitive data handling represents a high-risk profile." } ``` Wait, I should check for IOCs. `clawhub.com` is mentioned in the homepage metadata. `Doctolib`, `Zocdoc`, `Calendly` are mentioned as examples of booking systems. Nothing looks like a malicious C2. One more check on "Malicious": "explicit instructions to... access unrelated sensitive data". It asks for Google Calendar. Is that "unrelated"? No, it's for an appointment manager. It asks for home location. Is that "unrelated"? No, it's for journey times. So not malicious. Final decision: `suspicious` due to the high-risk nature of automated PII-based web transactions and persistence via cron jobs, as per the provided classification threshold. ```json { "classification": "suspicious", "summary": "The skill manages the full appointment lifecycle by collecting sensitive user information (Name, DOB, and home address) and performing automated web bookings via browser tools. It implements a persistence mechanism using scheduled cron jobs in SKILL.md to trigger future agent turns. While these capabilities are aligned with the stated purpose of an appointment manager, the combination of automated web transactions involving PII and the use of persistent background tasks constitutes a high-risk profile according to the analysis criteria." } ```