Book Braids

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI02: Tool Misuse and Exploitation

What this means

If used without careful confirmation, the agent could create an appointment with the wrong provider, service, time, or contact details.

Why it was flagged

The skill exposes a state-changing booking action. This is purpose-aligned, but a booking should be treated as a final user-approved action.

Skill content

"name": "create_booking", "arguments": { "providerId": "xxx", "serviceId": "yyy", "timeSlot": "2025-02-10T14:00:00-08:00"

Recommendation

Confirm the provider, service, time slot, and contact details with the user immediately before calling create_booking.

NoteHigh Confidence

ASI07: Insecure Inter-Agent Communication

What this means

Your name, email address, phone number, and appointment details may be shared with Lokuli's MCP service when creating a booking.

Why it was flagged

The skill sends personal contact information to a remote MCP endpoint as part of booking.

Skill content

"https://lokuli.com/mcp/sse" ... "customerName": "John Doe", "customerEmail": "john@example.com", "customerPhone": "+13105551234"

Recommendation

Only provide contact information you are comfortable sharing with Lokuli, and use the booking action only after confirming you trust the service.