Book Notary
PassAudited by VirusTotal on May 12, 2026.
Overview
Type: OpenClaw Skill Name: book-notary Version: 1.0.1 The skill bundle defines a legitimate purpose: booking notary services through Lokuli MCP. The `SKILL.md` file outlines the skill's description, an external endpoint (`https://lokuli.com/mcp/sse`), and three tools (`search`, `check_availability`, `create_booking`) that align with this purpose. While the `create_booking` tool handles Personally Identifiable Information (PII) like customer name, email, and phone, this is necessary and expected for a booking service. There is no evidence of data exfiltration to unauthorized endpoints, malicious execution, persistence, prompt injection attempts to subvert the agent, or obfuscation. The minor typo 'uook notary' in the title is not indicative of malicious intent.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The agent may be able to schedule an appointment with a notary service if the user provides the needed details.
The skill exposes a tool that can create an external notary booking. This matches the stated purpose, but it is a real-world action that should be user-confirmed.
"name": "create_booking", "arguments": { "providerId": "xxx", "serviceId": "yyy", "timeSlot": "2025-02-10T14:00:00-08:00"Only proceed after reviewing the provider, date, time, price or terms if shown, and contact details; ask the agent to confirm before creating the booking.
Your name, email, phone number, location or ZIP code, and appointment preferences may be sent to Lokuli or its providers to search and book services.
The skill uses an external MCP endpoint and the documented booking request includes personal contact information. This is expected for booking but involves sharing user data with a third-party service.
https://lokuli.com/mcp/sse ... "customerName": "John Doe", "customerEmail": "john@example.com", "customerPhone": "+13105551234"
Share only the information needed for the booking and review Lokuli’s privacy and service terms if this data is sensitive.
It may be harder to independently verify who operates or maintains the skill and its referenced MCP service.
The registry information does not provide a source repository or homepage for independent verification. There is no code to install, so this is a provenance note rather than a concrete unsafe behavior.
Source: unknown; Homepage: none
Use it only if you are comfortable with the listed Lokuli endpoint and avoid sharing unnecessary personal information.