Book Laundry

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI02: Tool Misuse and Exploitation

What this means

If used without confirming details, the agent could place an unwanted laundry booking.

Why it was flagged

The skill documents a tool call that can create a real service booking. This is aligned with the skill’s purpose, but booking is a user-impacting action that should be confirmed before execution.

Skill content

"name": "create_booking", "arguments": { "providerId": "xxx", "serviceId": "yyy", "timeSlot": "2025-02-10T14:00:00-08:00"

Recommendation

Confirm the provider, service, time slot, price, and cancellation terms with the user before calling create_booking.

Note

ASI07: Insecure Inter-Agent Communication

What this means

Your name, email, phone number, and booking details may be shared with Lokuli or the laundry provider.

Why it was flagged

The skill sends booking details, including contact information, to an external MCP endpoint. This is expected for a booking workflow, but it is still sensitive data sharing.

Skill content

https://lokuli.com/mcp/sse ... "customerName": "John Doe", "customerEmail": "john@example.com", "customerPhone": "+13105551234"

Recommendation

Only provide the contact details needed for the booking and review the provider’s privacy and booking terms if available.