Book Nails

PassAudited by ClawScan on May 10, 2026.

Overview

This is a coherent instruction-only nail-booking integration, but it can send your contact details to Lokuli and create an appointment.

This skill appears appropriate for finding and booking nail services. Before installing or using it, be aware that it talks to Lokuli's external MCP service and may send your name, email, phone number, location/ZIP, service choice, and appointment time. Ask the agent to confirm all details before it creates a booking.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

A mistaken or premature tool call could create a booking with incorrect details.

Why it was flagged

The skill documents a tool that can create an appointment and submit customer contact information. This is aligned with the booking purpose, but it is an external action that should be user-confirmed.

Skill content
"name": "create_booking", "arguments": { "providerId": "xxx", "serviceId": "yyy", "timeSlot": "2025-02-10T14:00:00-08:00", "customerName": "John Doe", "customerEmail": "john@example.com", "customerPhone": "+13105551234" }
Recommendation

Confirm the provider, service, time slot, name, email, and phone number with the user before calling create_booking.

What this means

Your booking query and contact details may be sent to Lokuli's service when the agent searches or books.

Why it was flagged

The skill communicates with an external MCP server. This is disclosed and purpose-aligned, but the artifact does not describe Lokuli's data handling boundaries for submitted booking details.

Skill content
MCP Endpoint

```
https://lokuli.com/mcp/sse
```

Transport: SSE | JSON-RPC 2.0 | POST requests
Recommendation

Only provide contact details you intend to share with the booking provider, and review the provider's privacy practices if needed.

What this means

Users have less registry-provided context for verifying who maintains the skill or the external service it points to.

Why it was flagged

The registry metadata does not provide source or homepage information, limiting independent provenance review. There is no local executable code in the supplied artifacts.

Skill content
Source: unknown
Homepage: none
Recommendation

Verify that the Lokuli MCP endpoint is the service you intend to use before sharing personal booking details.