Book Painter

• Analyzed: May 14, 2026, 3:30 AM
• Findings: 1
• Version: 1.0.1
• Hash: d2f8aaddb4a013e22733db01b37753619f82374b88549fc4c071906bea306d9c
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle defines a 'book-painter' service that interacts with an external Lokuli MCP endpoint (https://lokuli.com/mcp/sse) using JSON-RPC 2.0. It provides tools for searching, checking availability, and creating bookings. While the `create_booking` tool handles customer PII (name, email, phone), this is directly aligned with the stated purpose of booking a service and is expected to be provided by the user. There is no evidence of malicious intent, data exfiltration beyond the skill's stated function, unauthorized command execution, or prompt injection attempts against the agent in `SKILL.md`.