Book Personal Trainer
v1.0.1Book personal-trainer services through Lokuli MCP. Use when user needs to find and book personal-trainer. Triggers on requests like "book a personal-trainer", "find personal-trainer near me", or any personal-trainer service request.
⭐ 0· 1.3k·0 current·0 all-time
byLokuli@edwardrodriguez703-design
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name/description (book personal trainers via Lokuli MCP) aligns with the SKILL.md which shows search, availability check, and booking RPCs. However the skill references an external MCP endpoint (https://lokuli.com/mcp/sse) but declares no credentials or environment variables. It's unclear whether the platform provides built-in auth for that endpoint or whether the skill should have required API keys; that omission reduces clarity/proportionality.
Instruction Scope
The instructions are narrowly scoped to search/check/create booking RPC calls (no unrelated actions). But the payload examples include hard-coded values (zipCode: "90640", fixed dates, and example customer contact details). The skill does not instruct the agent to prompt the user for their actual zip code, date/time preferences, or contact info; if used as-is the skill could default to incorrect data or inadvertently submit placeholders. Using fixed location and PII-like example values is a functional and privacy concern.
Install Mechanism
This is an instruction-only skill with no install spec and no code files, so nothing is written to disk and no external packages are fetched. That minimizes install-time risk.
Credentials
The skill requests no environment variables or credentials but expects to call an external MCP endpoint. Booking services typically require authentication (API key, token, or platform-scoped tool permissions). The absence of any declared credential or primaryEnv is surprising and could indicate incomplete metadata or an assumption that platform-level tools provide the auth — the mismatch is concerning because it affects whether the skill can actually operate as described and whether auth would be handled securely.
Persistence & Privilege
always is false and there are no install-time or persistence actions described. The skill does not request persistent privileges or modify other skills' configs.
What to consider before installing
This skill looks like it does what it says (search/check/create bookings), but there are unclear and potentially risky gaps. Before installing, ask: (1) How is authentication to https://lokuli.com/mcp/sse handled? Should the skill declare an API key or rely on platform tools? (2) Will the agent prompt users for their location/contact info and preferred times, or will it use the hard-coded zipCode and example customer data in SKILL.md? (3) Who operates the Lokuli endpoint (no homepage/source given)? If you proceed, insist the skill be updated to remove hard-coded defaults, explicitly request only the credentials it needs (and document how they're stored/used), and confirm the platform's tool-layer provides any required auth rather than the skill embedding secrets.Like a lobster shell, security has layers — review code before you run it.
latestvk9707mpjx5njk6rseh4757a4m180njbp
License
MIT-0
Free to use, modify, and redistribute. No attribution required.