ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Book Party

v1.0.1

Book party services through Lokuli MCP. Use when user needs to find and book party. Triggers on requests like "book a party", "find party near me", or any party service request.

⭐ 0· 1.4k·0 current·0 all-time
byLokuli@edwardrodriguez703-design
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description (book party via Lokuli MCP) align with the instructions: the SKILL.md defines an MCP endpoint and JSON-RPC tool calls (search, check_availability, create_booking) that are appropriate for finding and booking party services.
ℹ
Instruction Scope
Instructions are narrowly scoped to calling Lokuli's MCP endpoint with JSON-RPC tool calls and do not request arbitrary file reads or unrelated env vars. Minor issues: the examples include hardcoded sample values (zipCode 90640, example dates, and a demo customer name/email/phone). The skill should explicitly instruct the agent to prompt the user for real customer contact details and location rather than using sample values.
✓
Install Mechanism
No install spec and no code files — instruction-only. This is low-risk because nothing is downloaded or written to disk by the skill itself.
ℹ
Credentials
The skill requests no environment variables or credentials. That is proportionate if Lokuli's MCP is accessible without auth or the platform supplies credentials. If Lokuli requires an API key, the SKILL.md should declare which credential is needed; absence of any auth declaration may be an omission to clarify before use.
✓
Persistence & Privilege
The skill does not request always:true and does not attempt to modify system or other-skill configurations. Normal agent autonomy (model invocation allowed) is fine here.
Assessment
This skill is instruction-only and appears coherent with its stated purpose, but before installing check: 1) whether Lokuli.com is a trusted service for you (the skill will send booking requests to that endpoint); 2) how the agent will obtain real customer info — the SKILL.md uses sample contact data and a sample zip code, so confirm it will prompt you for correct name, email, phone, date/time, and location rather than using placeholders; 3) whether Lokuli requires authentication (the skill does not declare any required API key or token) — if so, verify how credentials are provided and stored; and 4) that you are comfortable the agent may place bookings on your behalf (costs, cancellations, privacy). If any of those are unclear, ask the skill author for documentation or avoid enabling the skill until clarified.

Like a lobster shell, security has layers — review code before you run it.

latestvk97dwmrqca4zsy0jwc88aw14xh80mwv1

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments