Book Fence

• Outcome: Pass
• Latest audit: May 28, 2026, 7:01 AM
• Version:
  1.0.1

Overview

The skill is a coherent fence-service booking integration, with expected external data sharing for bookings but no evidence of hidden execution, persistence, or unrelated access.

Before installing, understand that booking through this skill may send your name, email, phone number, and booking details to Lokuli or its service providers. Confirm the details before asking it to create a booking, and avoid providing contact information unless you intend to proceed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger text is broad enough to activate on generic 'find fence' or related service requests without clearly constraining the workflow to intentional booking actions. This increases the chance the agent invokes an external MCP service unexpectedly, which can lead to unnecessary third-party contact or premature progression toward a booking flow.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The skill includes a booking call that transmits personal data including name, email, and phone number to an external endpoint, but the skill description does not disclose this data sharing. Users and downstream agents may therefore initiate bookings without informed consent, creating privacy, compliance, and trust risks when sensitive contact information is sent to a third party.

VirusTotal

66/66 vendors flagged this skill as clean.