Book Pet Grooming

• Outcome: Pass
• Latest audit: May 28, 2026, 7:01 AM
• Version:
  1.0.1

Overview

This skill appears to be a straightforward pet-grooming booking integration with Lokuli, with expected but privacy-relevant sharing of booking contact details.

Install only if you are comfortable using Lokuli for pet-grooming booking. Before creating a booking, confirm the provider, time, and contact details, and treat the name, email, and phone number as information that will be sent to the external booking service.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger text is broad enough to activate on generic pet-service requests, which can cause the agent to invoke this skill outside the user's intended scope. In a booking skill connected to an external MCP endpoint, over-triggering increases the chance of unnecessary third-party queries and accidental progression toward booking flows without clear user intent.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The skill collects and transmits personal contact details such as name, email, and phone number to an external MCP service, but the skill text does not disclose that this data leaves the local agent context. This creates a meaningful privacy and consent risk because users may provide sensitive personal data without understanding it will be shared with a third party.

VirusTotal

66/66 vendors flagged this skill as clean.