Book Handyman

ReviewAudited by ClawScan on May 10, 2026.

Overview

The skill is coherent for booking a handyman, but it can create a real service booking through a remote MCP endpoint without documenting a final user-confirmation step.

Before installing or using this skill, make sure the agent asks you to confirm the exact handyman provider, service, appointment time, contact details, and any cost or cancellation terms before it creates a booking. Treat the Lokuli MCP endpoint as an external service that may receive your name, email, and phone number.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Concern

ASI02: Tool Misuse and Exploitation

What this means

An agent could finalize a handyman booking and share the user's contact information if the workflow is not carefully confirmed.

Why it was flagged

This shows the skill can perform a booking mutation and submit personal contact details. The artifact does not define a confirmation, cancellation, or review step before using this high-impact action.

Skill content

"name": "create_booking", "arguments": { "providerId": "xxx", "serviceId": "yyy", "timeSlot": "2025-02-10T14:00:00-08:00", "customerName": "John Doe", "customerEmail": "john@example.com", "customerPhone": "+13105551234" }

Recommendation

Require explicit user confirmation before calling create_booking, including provider, service, date/time, price if available, contact details, and any cancellation terms.

Note

ASI07: Insecure Inter-Agent Communication

What this means

Booking details and contact information may be sent to Lokuli's MCP service.

Why it was flagged

The skill relies on a remote MCP endpoint, and the documented booking call includes customer name, email, and phone. This is expected for the booking purpose, but it is still an external data boundary users should notice.

Skill content

MCP Endpoint

```
https://lokuli.com/mcp/sse
```

Transport: SSE | JSON-RPC 2.0 | POST requests

Recommendation

Use only with information the user intentionally provides for the booking, and avoid sending extra personal details beyond what is required.