Book Language Tutor

Book language-tutor services through Lokuli MCP. Use when user needs to find and book language-tutor. Triggers on requests like "book a language-tutor", "find language-tutor near me", or any language-tutor service request.

Security Scan

The skill's stated purpose (booking language tutors) lines up broadly with its instructions, but there are several unexplained or risky choices (an external MCP endpoint with no declared auth, hardcoded location/date examples, and sample PII fields) that could lead to unintended data sharing.

Purpose & Capability

Name/description claim to find and book language tutors and the SKILL.md shows JSON-RPC calls for search, availability, and create_booking — that matches. However, the SKILL.md references an external MCP endpoint (https://lokuli.com/mcp/sse) but the skill declares no credentials or configuration for that endpoint. Additionally, the search example hardcodes zipCode: "90640" and date examples are fixed, which conflicts with the trigger "find language-tutor near me" (should use user-provided or detected location). These mismatches are unexplained and reduce coherence.

Instruction Scope

Instructions are limited to three RPC-style tool calls (search, check_availability, create_booking) which is scoped to booking. But SKILL.md includes example customerName/customerEmail/customerPhone fields and gives no guidance on obtaining explicit user consent, validating or limiting what PII is sent, or how to handle errors. The document is also vague about authentication and when/how the agent should call the external MCP endpoint vs. rely on platform tools, giving the agent broad discretion that could result in unintended transmission of personal data.

Install Mechanism

There is no install spec and no code files (instruction-only). That minimizes filesystem/installation risk.

Credentials

The skill declares no required env vars or credentials, yet it references an external service endpoint. Either the platform's 'tools/call' abstraction handles auth (not documented), or the skill is missing required auth details. The absence of declared API keys or tokens while instructing calls to an external MCP endpoint is a proportionality/information gap that should be clarified.

Persistence & Privilege

always is false, no install or code, and the skill does not request persistent agent-level privileges. It does not attempt to modify other skills or system settings.

What to consider before installing

This skill appears to implement booking flows but has gaps you should clarify before installing: (1) Verify how the agent authenticates to https://lokuli.com/mcp/sse — where are API keys stored and why aren't they declared? (2) Confirm that the agent will ask for explicit user consent before sending personal data (name, email, phone) and will not auto-fill/send profile data without confirmation. (3) Ask why zipCode (90640) and fixed dates appear in examples — ensure the skill will use the user's actual location and requested dates rather than hardcoded values. (4) Prefer a published source/homepage or documentation showing the MCP API and expected authentication. If you cannot get answers, treat the skill as risky because it may transmit PII to an external endpoint without clear controls.

uook language tutor

Book language-tutor services through Lokuli's MCP server.

MCP Endpoint

https://lokuli.com/mcp/sse

Transport: SSE | JSON-RPC 2.0 | POST requests

Tools

search

{
  "method": "tools/call",
  "params": {
    "name": "search",
    "arguments": {
      "query": "language-tutor",
      "zipCode": "90640",
      "maxResults": 20
    }
  }
}

check_availability

{
  "method": "tools/call",
  "params": {
    "name": "check_availability",
    "arguments": {
      "providerId": "xxx",
      "serviceId": "yyy",
      "date": "2025-02-10"
    }
  }
}

create_booking

{
  "method": "tools/call",
  "params": {
    "name": "create_booking",
    "arguments": {
      "providerId": "xxx",
      "serviceId": "yyy",
      "timeSlot": "2025-02-10T14:00:00-08:00",
      "customerName": "John Doe",
      "customerEmail": "[e-mail]",
      "customerPhone": "[phone]"
    }
  }
}