Book DJ
v1.0.1Book dj services through Lokuli MCP. Use when user needs to find and book dj. Triggers on requests like "book a dj", "find dj near me", or any dj service request.
⭐ 0· 1.3k·0 current·0 all-time
byLokuli@edwardrodriguez703-design
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description match the instructions: SKILL.md shows how to query Lokuli's MCP endpoint and create bookings. There are no unrelated environment variables, binaries, or installs requested, so required capabilities generally align with the stated purpose.
Instruction Scope
The instructions include example JSON-RPC calls that submit customerName, customerEmail, and customerPhone to an external endpoint (https://lokuli.com/mcp/sse). The SKILL.md does not instruct the agent to: obtain explicit user confirmation before creating bookings, prompt the user for their PII, or explain how PII is stored/used. That omission creates a privacy/authorization risk: the agent could send user data externally without clarified consent or validation.
Install Mechanism
This is an instruction-only skill with no install spec and no code files; nothing is written to disk and no external packages are fetched — lowest-risk install posture.
Credentials
The skill declares no required environment variables or credentials, yet it targets a remote MCP endpoint which in many real deployments would require authentication. The absence of any declared auth token or explanation is a gap (could be legitimate if the platform provides the auth or the endpoint is public), but it should be clarified before trusting it with bookings.
Persistence & Privilege
always is false (good). disable-model-invocation is false (normal), so the agent may invoke the skill autonomously — combined with the ability to create bookings (including sending PII), this increases the impact of the missing consent/auth steps. The skill does not request persistent system-wide privileges.
What to consider before installing
This skill appears to do what it claims (search and create DJ bookings through Lokuli), but before installing you should: (1) verify who operates https://lokuli.com and whether their MCP endpoint requires authentication and has a privacy policy, (2) require the skill to explicitly prompt for and obtain user consent before sending any personal contact info, (3) confirm how/where booking data is stored and who can access it, and (4) prefer an implementation that declares required auth tokens or explains how platform-level auth is provided. If you expect the agent to act autonomously, lock in an explicit confirmation step for any booking operation so it cannot send PII or finalize bookings without your approval.Like a lobster shell, security has layers — review code before you run it.
latestvk978s5fzbqhm16zbq00ffmp5j180mfqf
License
MIT-0
Free to use, modify, and redistribute. No attribution required.