Book Battery

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The agent could potentially create a service booking or share the user's contact details before the user has clearly approved the final provider and time.

Why it was flagged

This shows the skill exposes a booking action that can submit personal contact details and create an appointment; SKILL.md does not include an explicit user-confirmation, cost-review, or cancellation safeguard before that action.

Skill content
"name": "create_booking" ... "timeSlot": "2025-02-10T14:00:00-08:00", "customerName": "John Doe", "customerEmail": "john@example.com", "customerPhone": "+13105551234"
Recommendation

Require explicit user confirmation immediately before create_booking, including provider, service, time, contact details, price or fees if available, and cancellation terms.

What this means

Name, email, phone number, ZIP code, and booking preferences may be shared with the remote provider as part of normal booking.

Why it was flagged

The skill discloses a remote MCP endpoint and booking payload fields that include personal contact information, so user data would be sent outside the local agent to Lokuli's service.

Skill content
https://lokuli.com/mcp/sse ... "customerEmail": "john@example.com", "customerPhone": "+13105551234"
Recommendation

Only send user-provided contact information after consent, and tell users that the details will be transmitted to Lokuli or its booking providers.

What this means

Users have limited provenance information for assessing who maintains the skill or validating the remote booking service beyond the disclosed endpoint.

Why it was flagged

The skill is instruction-only, but the registry metadata does not provide a source repository or homepage to independently verify the remote integration.

Skill content
Source: unknown
Homepage: none
Recommendation

Prefer a version with a verifiable homepage or source link, and confirm that lokuli.com is the intended service before using it for bookings.