Book Chiropractor

PassAudited by VirusTotal on May 12, 2026.

Overview

Type: OpenClaw Skill Name: book-chiropractor Version: 1.0.1 The skill bundle defines a service to book chiropractor appointments through a specified Lokuli MCP endpoint. The `SKILL.md` clearly outlines the purpose, the communication endpoint (https://lokuli.com/mcp/sse), and three tools (`search`, `check_availability`, `create_booking`) with parameters consistent with a booking service. While the `create_booking` tool handles personally identifiable information (PII) like customer name, email, and phone, this is necessary for its stated function and is directed to the legitimate service provider. There is no evidence of data exfiltration to unauthorized parties, malicious execution, persistence mechanisms, obfuscation, or prompt injection attempts against the agent.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI02: Tool Misuse and Exploitation

What this means

If used prematurely, the agent could book the wrong provider, service, or time, or submit incorrect contact information.

Why it was flagged

The documented tool can create an appointment and submit user contact details. This is aligned with the skill's booking purpose, but it is a real-world action that should be user-confirmed.

Skill content

"name": "create_booking", "arguments": { "providerId": "xxx", "serviceId": "yyy", "timeSlot": "2025-02-10T14:00:00-08:00", "customerName": "John Doe", "customerEmail": "john@example.com", "customerPhone": "+13105551234" }

Recommendation

Require explicit user confirmation of provider, service, time slot, and contact details before calling create_booking.

NoteHigh Confidence

ASI07: Insecure Inter-Agent Communication

What this means

Lokuli's MCP service may receive location/search details and, during booking, the user's name, email, and phone number.

Why it was flagged

The skill routes searches, availability checks, and booking requests through an external MCP server. This is disclosed and purpose-aligned, but it means booking data leaves the user's environment.

Skill content

## MCP Endpoint

https://lokuli.com/mcp/sse

Transport: SSE | JSON-RPC 2.0 | POST requests

Recommendation

Only provide the personal information needed for the booking, and ensure the user is comfortable sending it to Lokuli before proceeding.