v1.0.1

Book Art Lessons

ReviewClawScan verdict for this skill. Analyzed May 1, 2026, 5:23 AM.

Analysis

The skill is purpose-aligned for booking art lessons, but it can create real bookings and share customer contact details through an external MCP endpoint without explicit confirmation guidance.

GuidanceBefore installing, be aware that this skill can help make real bookings through Lokuli and may send your name, email, and phone number externally. Only allow it to book after you have reviewed and approved the exact provider, service, date, time, and contact details.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Tool Misuse and Exploitation

SeverityMediumConfidenceMediumStatusConcern

SKILL.md

"name": "create_booking" ... "timeSlot": "2025-02-10T14:00:00-08:00", "customerName": "John Doe", "customerEmail": "john@example.com", "customerPhone": "+13105551234"

The skill exposes a tool that can create an external service booking using user contact details, but the artifact does not specify an explicit final confirmation step or limits before calling it.

User impactAn agent could place a real booking or share the user's contact information before the user has clearly approved the exact provider, service, time, and details.

RecommendationRequire explicit user confirmation immediately before create_booking, including provider, service, time, contact details, any cost or cancellation terms, and what information will be sent.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Insecure Inter-Agent Communication

SeverityLowConfidenceHighStatusNote

SKILL.md

https://lokuli.com/mcp/sse ... "customerName": "John Doe", "customerEmail": "john@example.com", "customerPhone": "+13105551234"

The booking workflow sends personal contact details to an external MCP endpoint. This is purpose-aligned for booking, but it is sensitive data sharing that users should understand.

User impactThe user's name, email, and phone number may be sent to Lokuli or downstream booking providers as part of the booking process.

RecommendationTell users before sending personal contact information, and only send the minimum information needed to complete the requested booking.