Book Makeup
v1.0.1Book makeup services through Lokuli MCP. Use when user needs to find and book makeup. Triggers on requests like "book a makeup", "find makeup near me", or any makeup service request.
⭐ 1· 1.3k·0 current·0 all-time
byLokuli@edwardrodriguez703-design
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description claim to book makeup via Lokuli MCP and the SKILL.md contains JSON-RPC calls and an MCP endpoint (lokuli.com). That is coherent with the stated purpose, but the skill provides no provenance (source/homepage unknown) and uses placeholder data (hardcoded zip, date, sample customer fields). No information is given about required auth or who operates the endpoint — plausible if the platform mediates auth, but this is not stated.
Instruction Scope
SKILL.md instructs the agent to call an external SSE/JSON-RPC endpoint and gives example JSON-RPC payloads for search, check_availability, and create_booking. The instructions do not instruct reading local files or unrelated environment variables, which is good, but they also do not instruct the agent to prompt the user for or to validate required customer data (name, email, phone) or to obtain consent before sending personal data to the external endpoint. Placeholders (providerId/serviceId/timeSlot) are present without guidance on how to obtain/replace them.
Install Mechanism
Instruction-only skill with no install spec and no code files — lowest-risk install surface. Nothing is written to disk by the skill package itself.
Credentials
The skill declares no required environment variables or credentials, yet it instructs calls to an external service (lokuli.com). Booking APIs commonly require authentication and data-handling guarantees; the lack of any declared auth or explanation of how requests will be authorized or how user PII is protected is disproportionate to the sensitive nature of booking operations.
Persistence & Privilege
The skill does not request always:true or any special persistent privileges. It is user-invocable and allows autonomous invocation (platform default) but does not demand elevated system presence or modify other skills.
What to consider before installing
Before installing or enabling this skill: 1) Confirm who operates the Lokuli endpoint (lokuli.com) and whether the platform will supply authentication — the SKILL.md provides no auth or privacy details. 2) Ask how and when the agent will collect and transmit your personal data (name, email, phone) and ensure you want it sent to this external service. 3) Prefer to require explicit user confirmation before any booking is created (don’t let the agent auto-send create_booking). 4) Test in a low-risk way (use dummy contact info) to observe behavior and network targets. 5) If you need stronger assurance, request a skill with documented API keys / OAuth steps or a verifiable homepage/source. Because provenance and auth handling are unclear, treat this skill with caution.Like a lobster shell, security has layers — review code before you run it.
latestvk976x5k8sqwj8a9k9rh0ghnzt580mgk7
License
MIT-0
Free to use, modify, and redistribute. No attribution required.