Book Nutritionist

Book nutritionist services through Lokuli MCP. Use when user needs to find and book nutritionist. Triggers on requests like "book a nutritionist", "find nutritionist near me", or any nutritionist service request.

Security Scan

The skill's stated purpose (finding/booking a nutritionist) matches the instructions, but the runtime instructions will send user contact data to an external MCP endpoint (lokuli.com) with no authentication or privacy guidance, which is surprising and warrants caution.

Purpose & Capability

The name/description align with the SKILL.md examples (search, check_availability, create_booking). However, the skill references an external MCP endpoint (https://lokuli.com/mcp/sse) but declares no credentials or auth mechanism — this is plausible if the MCP is public but is unusual for a booking API and should be justified.

Instruction Scope

The instructions include explicit JSON-RPC payloads that contain/require customer PII (name, email, phone) and a zip code. They direct the agent to interact with an external service (lokuli.com) but do not instruct the agent to obtain explicit user consent, validate input, or show the outgoing payload before sending. Hard-coded example values and dates are present, which is sloppy and could lead to accidental data leakage if not replaced.

Install Mechanism

Instruction-only skill with no install spec or code files — nothing is written to disk and no third-party packages are fetched, which minimizes install-time risk.

Credentials

The skill declares no required environment variables or credentials, yet it calls an external MCP endpoint and will transmit user PII. Booking APIs commonly require API keys/auth; absence of declared credentials is unexpected. There is a proportionality concern: transmitting PII to an external domain without clear auth, affiliation, or privacy guidance is not justified by the description alone.

Persistence & Privilege

The skill does not request always:true and has no install-time persistence. It does not modify agent configuration or request elevated platform privileges.

What to consider before installing

This skill will send user contact information (name, email, phone) and location (zip code) to the external endpoint https://lokuli.com/mcp/sse. Before installing or using it, verify who operates lokuli.com and whether you trust them with PII; confirm the booking flow requires no API key or how authentication is handled; insist the agent prompt for and display the exact booking payload and ask for user consent before sending; and avoid providing real personal data until you’ve confirmed the service’s legitimacy and privacy practices. If you need stronger guarantees, prefer a skill that declares its auth method (API key) and documents data handling. If you want, I can draft a set of safety prompts the agent should use (consent, data preview, and validation) to reduce risk.

uook nutritionist

Book nutritionist services through Lokuli's MCP server.

MCP Endpoint

https://lokuli.com/mcp/sse

Transport: SSE | JSON-RPC 2.0 | POST requests

Tools

search

{
  "method": "tools/call",
  "params": {
    "name": "search",
    "arguments": {
      "query": "nutritionist",
      "zipCode": "90640",
      "maxResults": 20
    }
  }
}

check_availability

{
  "method": "tools/call",
  "params": {
    "name": "check_availability",
    "arguments": {
      "providerId": "xxx",
      "serviceId": "yyy",
      "date": "2025-02-10"
    }
  }
}

create_booking

{
  "method": "tools/call",
  "params": {
    "name": "create_booking",
    "arguments": {
      "providerId": "xxx",
      "serviceId": "yyy",
      "timeSlot": "2025-02-10T14:00:00-08:00",
      "customerName": "John Doe",
      "customerEmail": "[e-mail]",
      "customerPhone": "[phone]"
    }
  }
}