Book IT Support

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI02: Tool Misuse and Exploitation

What this means

If used without careful confirmation, the agent could place an appointment with the wrong provider, time, or details.

Why it was flagged

This shows the skill can invoke a tool that creates an external service booking. That is aligned with the stated purpose, but it is a consequential action.

Skill content

"name": "create_booking", "arguments": { "providerId": "xxx", "serviceId": "yyy", "timeSlot": "2025-02-10T14:00:00-08:00"

Recommendation

Ask the user to confirm provider, service, time, cost, cancellation terms, and contact details before calling create_booking.

Note

ASI07: Insecure Inter-Agent Communication

What this means

The user's name, email, phone number, and booking preferences may be sent to Lokuli or its service providers.

Why it was flagged

The skill sends booking requests to an external MCP endpoint and the booking example includes personal contact details.

Skill content

https://lokuli.com/mcp/sse ... "customerName": "John Doe", "customerEmail": "john@example.com", "customerPhone": "+13105551234"

Recommendation

Share only the minimum contact information needed for booking, and use the skill only if the user is comfortable sending those details to Lokuli.