Book Laundry

PassAudited by ClawScan on May 10, 2026.

Overview

This skill is coherently focused on finding and booking laundry, but it uses an external MCP service and may send contact details when creating a booking.

Before installing or using this skill, make sure you are comfortable sharing booking contact details with Lokuli, and ask the agent to confirm the exact provider, time, price, and cancellation policy before it creates any booking.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI02: Tool Misuse and Exploitation

What this means

If used without confirming details, the agent could place an unwanted laundry booking.

Why it was flagged

The skill documents a tool call that can create a real service booking. This is aligned with the skill’s purpose, but booking is a user-impacting action that should be confirmed before execution.

Skill content

"name": "create_booking", "arguments": { "providerId": "xxx", "serviceId": "yyy", "timeSlot": "2025-02-10T14:00:00-08:00"

Recommendation

Confirm the provider, service, time slot, price, and cancellation terms with the user before calling create_booking.

Note

ASI07: Insecure Inter-Agent Communication

What this means

Your name, email, phone number, and booking details may be shared with Lokuli or the laundry provider.

Why it was flagged

The skill sends booking details, including contact information, to an external MCP endpoint. This is expected for a booking workflow, but it is still sensitive data sharing.

Skill content

https://lokuli.com/mcp/sse ... "customerName": "John Doe", "customerEmail": "john@example.com", "customerPhone": "+13105551234"

Recommendation

Only provide the contact details needed for the booking and review the provider’s privacy and booking terms if available.