Book Gutter Cleaning

• Outcome: Review
• Latest audit: May 28, 2026 at 7:01 AM UTC
• Version:
  1.0.1

Overview

The skill is coherent for booking gutter-cleaning, but it can create an external booking and send personal contact details without a clear final-consent step.

Install only if you are comfortable using Lokuli for gutter-cleaning search and booking. Before any booking is submitted, verify the provider, service, appointment time, price or terms if shown, and the exact name, email, and phone number that will be sent.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger condition is broad enough to activate on essentially any gutter-cleaning request, which can cause the skill to engage before the user has clearly consented to using this specific third-party booking flow. In context, that increases the chance of premature data collection or unintended transmission of booking-related information to the external Lokuli MCP service.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill includes booking parameters for customerName, customerEmail, and customerPhone but does not warn the user that this personal data will be sent to a third-party endpoint. In a booking skill tied to an external MCP server, lack of disclosure and consent makes unintended PII exfiltration more likely and weakens user control over sensitive contact information.

VirusTotal

65/65 vendors flagged this skill as clean.