Book Music Lessons

• Outcome: Pass
• Latest audit: May 28, 2026, 7:01 AM
• Version:
  1.0.1

Overview

This is a straightforward music-lesson booking skill, with the main caution that booking sends contact details to Lokuli's external service.

Install only if you are comfortable using Lokuli as the booking provider. Before creating a booking, confirm the lesson, provider, time slot, and the contact details that will be sent externally.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger description is broad enough to activate on generic service-booking requests, which can cause the skill to run when the user did not specifically intend to use this external booking integration. That increases the chance of unnecessary transmission of user context to a third-party MCP endpoint and can lead to unintended booking-related actions being proposed or initiated.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill collects and transmits personal data including name, email, and phone number to an external service, but the description provides no user-facing warning, consent step, or data-handling disclosure. This creates a meaningful privacy and compliance risk because users may not realize their personal booking data will be sent to a third-party endpoint.

VirusTotal

66/66 vendors flagged this skill as clean.