v1.0.1

Book Computer Repair

ReviewClawScan verdict for this skill. Analyzed May 1, 2026, 5:24 AM.

Analysis

This skill appears aligned with booking computer repair, but it can send personal contact details to an external MCP service and create a real booking without documented confirmation or reversal safeguards.

GuidanceBefore installing or using this skill, confirm that you trust Lokuli and require the agent to ask before creating any booking. Do not let it submit your name, email, phone number, preferred time, or location unless you have reviewed the provider, price, schedule, and cancellation terms.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Tool Misuse and Exploitation

SeverityMediumConfidenceHighStatusConcern

SKILL.md

"name": "create_booking", "arguments": { "providerId": "xxx", "serviceId": "yyy", "timeSlot": "2025-02-10T14:00:00-08:00", "customerName": "John Doe", "customerEmail": "john@example.com", "customerPhone": "+13105551234" }

The skill documents a tool that creates a booking using personal contact details. The artifact does not pair this high-impact action with an explicit final confirmation or review requirement.

User impactIf used too aggressively, an agent could create an unwanted appointment or service request and share the user's contact details before the user has reviewed the provider, time, price, or cancellation terms.

RecommendationRequire explicit user confirmation of provider, service, time slot, contact details, price/fees, and cancellation terms before calling create_booking.

Agentic Supply Chain Vulnerabilities

SeverityLowConfidenceHighStatusNote

metadata

Source: unknown; Homepage: none

The registry information does not provide a source repository or homepage to independently verify the operator, documentation, or privacy/security posture of the external booking integration.

User impactUsers have less information for deciding whether to trust the external service endpoint used for bookings.

RecommendationVerify that the Lokuli MCP endpoint and publisher are trusted before installing or using the skill for real bookings.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Insecure Inter-Agent Communication

SeverityLowConfidenceHighStatusNote

SKILL.md

"https://lokuli.com/mcp/sse" ... "customerName": "John Doe", "customerEmail": "john@example.com", "customerPhone": "+13105551234"

The skill routes booking operations through an external MCP endpoint and the documented booking arguments include personal contact information.

User impactThe user's name, email, phone number, zip code, and requested service details may be sent to Lokuli's MCP service as part of booking.

RecommendationOnly use the booking flow after the user agrees to share the required contact information with Lokuli/the selected provider, and avoid sending unnecessary personal details.