Book Mechanic

PassAudited by ClawScan on May 10, 2026.

Overview

Book Mechanic is a coherent booking integration, but it can send your contact details to an external MCP service and create a mechanic booking.

This skill appears purpose-aligned for finding and booking a mechanic. Before using it, be aware that it contacts an external Lokuli MCP service and may send your zip code, name, email, and phone number. Confirm all booking details before allowing a booking to be created.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The agent could create an appointment with a mechanic if the booking tool is used.

Why it was flagged

The skill documents a tool call that can create an external mechanic booking. This is aligned with the skill purpose, but it is a real-world action that should only happen after the user confirms the details.

Skill content
"name": "create_booking", "arguments": { "providerId": "xxx", "serviceId": "yyy", "timeSlot": "2025-02-10T14:00:00-08:00", "customerName": "John Doe"
Recommendation

Before any create_booking call, confirm the mechanic, service, date/time, and contact details with the user.

What this means

Your zip code and contact details may be shared with the Lokuli MCP service to search or book mechanic services.

Why it was flagged

The skill uses an external MCP endpoint and the booking example includes customer email and phone number. This data flow is expected for booking, but it means personal information is sent outside the local agent environment.

Skill content
https://lokuli.com/mcp/sse ... "customerEmail": "john@example.com", "customerPhone": "+13105551234"
Recommendation

Only provide information needed for the booking, and verify that you trust Lokuli before sharing contact details.

What this means

It may be harder to independently verify who operates the external booking service or review its behavior.

Why it was flagged

The registry metadata does not provide a source repository or homepage. There is no local code to install, but the remote service provenance is not strongly documented in the supplied artifacts.

Skill content
Source: unknown; Homepage: none
Recommendation

Use this skill only if you trust the listed Lokuli endpoint, and check the provider separately if provenance matters.