Book Blowout
ReviewAudited by ClawScan on May 10, 2026.
Overview
This is a plausible blowout-booking skill, but it can create a real appointment through a remote MCP endpoint using the user's contact details without stating clear final-confirmation safeguards.
Before installing or using this skill, confirm that you trust Lokuli for booking and require the agent to ask for explicit approval before creating any appointment or sending your name, email, phone number, and location.
Findings (2)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The agent could place a real appointment before the user has reviewed all details, which may cause inconvenience, cancellation issues, or unwanted sharing of contact information.
The skill documents a remote tool call that can create a booking with user contact details, but the artifact does not define approval, cancellation, price, or final-review requirements before invoking it.
"name": "create_booking", "arguments": { "providerId": "xxx", "serviceId": "yyy", "timeSlot": "2025-02-10T14:00:00-08:00", "customerName": "John Doe"Only allow booking after explicit user confirmation of the provider, service, date/time, price, cancellation policy, and exact contact details to be submitted.
Using the skill may disclose the user's location, preferred appointment time, name, email, and phone number to the remote booking service.
The skill uses a remote MCP endpoint and the booking example includes email and phone fields, so personal contact data may be sent to Lokuli or downstream booking providers.
https://lokuli.com/mcp/sse ... "customerEmail": "john@example.com", "customerPhone": "+13105551234"
Provide only the information needed for the booking and verify that Lokuli is an intended and trusted service before submitting personal details.