Book Art Lessons

Book art-lessons services through Lokuli MCP. Use when user needs to find and book art-lessons. Triggers on requests like "book a art-lessons", "find art-lessons near me", or any art-lessons service request.

Security Scan

The skill's stated purpose (finding and booking art lessons) matches its instructions, but there are several inconsistencies and missing details — notably an external MCP endpoint with no authentication guidance, hard-coded example data, and unclear data flows — that warrant caution before use.

Purpose & Capability

Name/description align with the instructions (search, check_availability, create_booking). However the SKILL.md references an external MCP endpoint (https://lokuli.com/mcp/sse) while providing no explanation of how authentication, authorization, or tenancy are handled — unusual for a service that performs bookings.

Instruction Scope

Instructions are narrowly scoped to searching and booking via JSON-RPC 'tools/call' methods and do not ask the agent to access arbitrary local files or unrelated credentials. Concerns: the SKILL.md hard-codes sample values (zipCode 90640, specific dates, and example customer details) instead of showing how to use user-provided inputs, and it explicitly names an external endpoint which implies transmitting user PII (customerName/email/phone) but does not document consent or data handling.

Install Mechanism

No install spec and no code files — instruction-only skill — so there is no code being downloaded or written to disk by the skill itself.

Credentials

The skill declares no required environment variables or credentials, yet it targets an external booking endpoint. Either the platform supplies credentials transparently or the skill is expected to work unauthenticated; the SKILL.md provides no guidance. This mismatch (external API but no declared auth) is disproportionate and worth verifying.

Persistence & Privilege

Skill is not marked 'always:true' and does not request persistent system-wide privileges. It appears to be a standard, user-invocable instruction-only skill.

What to consider before installing

This skill appears to do what it claims, but before installing verify who runs the 'lokuli.com' MCP endpoint and how authentication is handled. Ask the publisher (or your platform) whether API keys or OAuth tokens are required and how the platform protects/obtains them. Be aware booking calls will send personal data (name, email, phone) to that external service — confirm privacy/consent. Also note the SKILL.md contains hard-coded example zip code and dates (likely placeholders); ensure the skill will use the user's real inputs rather than those static values. If you can't validate the endpoint/operator or the auth/data-handling model, avoid installing or using the skill with real personal information.

uook art lessons

Book art-lessons services through Lokuli's MCP server.

MCP Endpoint

https://lokuli.com/mcp/sse

Transport: SSE | JSON-RPC 2.0 | POST requests

Tools

search

{
  "method": "tools/call",
  "params": {
    "name": "search",
    "arguments": {
      "query": "art-lessons",
      "zipCode": "90640",
      "maxResults": 20
    }
  }
}

check_availability

{
  "method": "tools/call",
  "params": {
    "name": "check_availability",
    "arguments": {
      "providerId": "xxx",
      "serviceId": "yyy",
      "date": "2025-02-10"
    }
  }
}

create_booking

{
  "method": "tools/call",
  "params": {
    "name": "create_booking",
    "arguments": {
      "providerId": "xxx",
      "serviceId": "yyy",
      "timeSlot": "2025-02-10T14:00:00-08:00",
      "customerName": "John Doe",
      "customerEmail": "[e-mail]",
      "customerPhone": "[phone]"
    }
  }
}