Synergy Salon

Manage Synergy salon — appointments, clients, social media, promotions, and website. Notion-powered scheduling and CRM.

Before installing, confirm where and how the skill will obtain credentials: Notion and Netlify both require API tokens and git pushes require credentials (SSH key or token). The registry metadata lists no required env vars — ask the skill author or inspect the source to see how auth is handled. Verify the skill's file access is restricted to only ~/synergy-website (or set a narrower path) and that deploys require explicit approval. Review the referenced GitHub repository (homepage) and the SKILL.md there to ensure there are no hidden steps. If you proceed, supply least-privilege tokens (scoped Netlify token, Notion integration limited to necessary DBs, a deploy key with only repo write access) and test in a staging site/repo first. If you cannot verify where secrets are stored or how deploys are authorized, do not install.

Type: OpenClaw Skill Name: synergy-salon Version: 1.0.0 The skill is classified as suspicious due to high-risk capabilities that could be exploited as vulnerabilities, even without explicit malicious intent within the skill's instructions. Specifically, the `salon site update [page] [content]` command, combined with `fileAccess: [~/synergy-website]` and `commands: [git, npm, netlify]` in `SKILL.md`, allows arbitrary content modification within the website directory and subsequent deployment. This presents a significant prompt-injection vulnerability against the agent, potentially leading to website defacement or remote code execution if a malicious user provides harmful content. Additionally, the skill accesses sensitive client PII (phone, email) via `salon remind` and `salon clients` commands, increasing the risk of data exposure if the agent is compromised.