Book Guitar Lessons

• Outcome: Pass
• Latest audit: May 28, 2026, 7:01 AM
• Version:
  1.0.1

Overview

This is a simple booking helper for guitar lessons, with expected third-party contact-data sharing when creating a booking.

Install only if you want an agent to help search and book guitar lessons through Lokuli. Before allowing a booking, confirm the provider, date, time, and the name, email, and phone number that will be sent to the external service.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The trigger text is broad enough to activate on generic service-booking requests, which can cause the agent to invoke this skill outside the user's clear intent to book guitar lessons. In an autonomous workflow, over-broad invocation can lead to unintended provider searches or downstream collection/transmission of user data to a third-party MCP endpoint.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The skill includes a booking flow that transmits personal data such as customer name, email, and phone number to an external MCP service, but it provides no user-facing warning, consent step, or data-handling notice. This creates a privacy and compliance risk because the agent may collect and send sensitive contact information without the user's informed authorization.

VirusTotal

64/64 vendors flagged this skill as clean.