Book Lashes
PassAudited by ClawScan on May 10, 2026.
Overview
This instruction-only skill appears to do what it says—use Lokuli’s MCP endpoint to search and book lash appointments—but users should confirm booking details before sharing contact information.
This skill is low-risk if used as intended. Before installing or invoking it, make sure you want your agent to contact Lokuli’s MCP service and only allow create_booking after you have reviewed the provider, service, appointment time, and contact information.
Findings (2)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If invoked prematurely, the agent could place an appointment the user did not fully confirm.
The skill exposes a tool call that can create a real appointment, which is purpose-aligned but should be used only after the user confirms the final booking details.
"name": "create_booking", "arguments": { "providerId": "xxx", "serviceId": "yyy", "timeSlot": "2025-02-10T14:00:00-08:00" }Confirm the provider, service, date/time, price or cancellation terms, and contact details before allowing the booking call.
The booking provider may receive and store the user's name, email, phone number, selected service, and appointment time.
The skill discloses a remote MCP endpoint and shows that customer contact details are sent when creating a booking.
https://lokuli.com/mcp/sse ... "customerName": "John Doe", "customerEmail": "john@example.com", "customerPhone": "+13105551234"
Only provide contact details you are comfortable sharing with Lokuli and the selected lash-service provider.