Book Extensions

PassAudited by ClawScan on May 10, 2026.

Overview

This instruction-only skill is coherently aimed at finding and booking extension appointments through Lokuli, but it can submit booking details and contact information to an external MCP service.

This skill appears appropriate if you intend to use Lokuli to find and book extension services. Before finalizing a booking, confirm the business, service, date, time, and contact details, and only share personal information you are comfortable sending to the external service.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

If used with real details, the agent could submit an appointment booking request on the user's behalf.

Why it was flagged

The skill documents a tool call that can create a real appointment booking. This is aligned with the stated purpose, but it is a user-impacting action.

Skill content
"name": "create_booking", ... "timeSlot": "2025-02-10T14:00:00-08:00", "customerName": "John Doe"
Recommendation

Confirm the provider, service, date, time, and contact details with the user before calling create_booking.

What this means

Lokuli may receive the user's location, appointment preferences, name, email, and phone number when making a booking.

Why it was flagged

The skill sends booking and contact information to a remote MCP endpoint. This is expected for a booking service, but it is an external data-sharing boundary.

Skill content
https://lokuli.com/mcp/sse ... "customerEmail": "john@example.com", "customerPhone": "+13105551234"
Recommendation

Only provide contact details you are comfortable sharing with Lokuli, and verify the service before submitting a booking.

What this means

Users have less information for independently verifying who maintains the skill and the remote service it uses.

Why it was flagged

The registry metadata does not provide a source repository or homepage for verifying the skill publisher or remote integration. No local code is installed, so this is a provenance note rather than a concrete unsafe behavior.

Skill content
Source: unknown; Homepage: none
Recommendation

Verify the Lokuli domain and publisher trustworthiness before relying on the skill for bookings.