Book Chiropractor

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI02: Tool Misuse and Exploitation

What this means

If used prematurely, the agent could book the wrong provider, service, or time, or submit incorrect contact information.

Why it was flagged

The documented tool can create an appointment and submit user contact details. This is aligned with the skill's booking purpose, but it is a real-world action that should be user-confirmed.

Skill content

"name": "create_booking", "arguments": { "providerId": "xxx", "serviceId": "yyy", "timeSlot": "2025-02-10T14:00:00-08:00", "customerName": "John Doe", "customerEmail": "john@example.com", "customerPhone": "+13105551234" }

Recommendation

Require explicit user confirmation of provider, service, time slot, and contact details before calling create_booking.

Note

ASI07: Insecure Inter-Agent Communication

What this means

Lokuli's MCP service may receive location/search details and, during booking, the user's name, email, and phone number.

Why it was flagged

The skill routes searches, availability checks, and booking requests through an external MCP server. This is disclosed and purpose-aligned, but it means booking data leaves the user's environment.

Skill content

## MCP Endpoint

https://lokuli.com/mcp/sse

Transport: SSE | JSON-RPC 2.0 | POST requests

Recommendation

Only provide the personal information needed for the booking, and ensure the user is comfortable sending it to Lokuli before proceeding.