Book Dance Lessons

Book dance-lessons services through Lokuli MCP. Use when user needs to find and book dance-lessons. Triggers on requests like "book a dance-lessons", "find dance-lessons near me", or any dance-lessons service request.

Security Scan

The skill's stated purpose (booking dance lessons via Lokuli MCP) is plausible, but the runtime instructions omit how authentication is handled, contain hard-coded example data, and would send user PII to an external endpoint without declaring any credentials — these gaps make the intent and safety unclear.

Purpose & Capability

Name and description match the instructions (calls to a Lokuli MCP endpoint using JSON-RPC to search, check availability, and create bookings). However, the skill declares no credentials or auth method while pointing to an external booking endpoint, which is unusual for a service that performs bookings on behalf of users.

Instruction Scope

SKILL.md shows JSON-RPC tool calls that would transmit customer PII (name, email, phone) and fixed parameters (zipCode=90640, sample dates) to https://lokuli.com/mcp/sse. The document provides no guidance on authentication, consent, or what data is required vs. optional. The presence of hard-coded example values and a stray typo ('uook dance lessons') suggests sloppy or incomplete instructions.

Install Mechanism

Instruction-only skill with no install spec and no code files. That minimizes disk-write risk; there is no package download or local install activity.

Credentials

The skill requests no environment variables or credentials, yet the runtime instructions call an external MCP endpoint that would normally require authentication. Absence of declared credentials is disproportionate and leaves unclear how bookings would be authorized. Also, the skill will involve sending user PII to an external domain — that should be explicitly justified and protected.

Persistence & Privilege

Defaults are used (not always:true). The skill does not request persistent or elevated platform privileges in the manifest.

What to consider before installing

This skill appears to do what it says (search and create bookings) but the SKILL.md is incomplete and could cause your agent to send user personal data to https://lokuli.com without explaining authentication or consent. Before installing: 1) ask the publisher for details on how the MCP endpoint is authenticated and where credentials are stored; 2) confirm the legitimacy of lokuli.com and ask for a privacy/data-flow statement (what data is sent, stored, retention); 3) request that example hard-coded values be removed and replaced with explicit prompts so PII is only sent with user consent; 4) test in a sandboxed environment and monitor network calls; and 5) prefer a skill that declares required credentials and has a verified homepage/owner. Providing the skill's owner info, an explicit auth flow, or an official homepage would increase confidence.

uook dance lessons

Book dance-lessons services through Lokuli's MCP server.

MCP Endpoint

https://lokuli.com/mcp/sse

Transport: SSE | JSON-RPC 2.0 | POST requests

Tools

search

{
  "method": "tools/call",
  "params": {
    "name": "search",
    "arguments": {
      "query": "dance-lessons",
      "zipCode": "90640",
      "maxResults": 20
    }
  }
}

check_availability

{
  "method": "tools/call",
  "params": {
    "name": "check_availability",
    "arguments": {
      "providerId": "xxx",
      "serviceId": "yyy",
      "date": "2025-02-10"
    }
  }
}

create_booking

{
  "method": "tools/call",
  "params": {
    "name": "create_booking",
    "arguments": {
      "providerId": "xxx",
      "serviceId": "yyy",
      "timeSlot": "2025-02-10T14:00:00-08:00",
      "customerName": "John Doe",
      "customerEmail": "[e-mail]",
      "customerPhone": "[phone]"
    }
  }
}