Book Plumber

Book plumber services through Lokuli MCP. Use when user needs to find and book plumber. Triggers on requests like "book a plumber", "find plumber near me", or any plumber service request.

Security Scan

The skill's instructions are broadly consistent with a plumber-booking flow, but provenance is unknown, it references an external MCP endpoint with no declared credentials, and the SKILL.md includes hard-coded example personal data and zip codes that could lead to accidental data leakage or misuse.

Purpose & Capability

Name and description (book a plumber via Lokuli MCP) match the SKILL.md which shows search, check_availability, and create_booking JSON-RPC calls to an MCP endpoint. There is no obvious extra functionality beyond booking.

Instruction Scope

Instructions confine actions to JSON-RPC calls against https://lokuli.com/mcp/sse and platform tool calls (search, check_availability, create_booking). However the doc contains hard-coded sample zip code (90640) and example PII (John Doe, [e-mail], [phone]) without telling the agent to prompt the user or confirm data — risk that the agent could use or transmit incorrect or test personal data. The SKILL.md also has minor typos but no instructions to read local files or environment variables.

Install Mechanism

No install spec and no code files (instruction-only). This minimizes on-disk persistence and arbitrary code execution risk.

Credentials

The skill declares no required environment variables or credentials but directs RPC calls to an external domain (lokuli.com). Real booking APIs typically require authentication; absence of declared credentials is unexplained. The skill will involve sending customer contact details to an external service (privacy risk) but does not document consent, data handling, or whether an API key is needed.

Persistence & Privilege

always is false and there is no installation or self-modifying behavior. The skill does not request elevated or persistent platform privileges.

What to consider before installing

This skill looks like a straightforward instruction-only integration that will make network calls to lokuli.com to search and create bookings, but its source and homepage are unknown. Before installing or using it: 1) Verify what lokuli.com is and whether you trust it to receive your personal contact and address data. 2) Confirm whether the service requires authentication and how credentials are supplied — the SKILL.md does not declare any API keys. 3) Ensure the agent will always prompt you to confirm or supply your real address/phone/email instead of using the hard-coded examples in the doc. 4) If you need privacy or auditability, test the skill in a sandbox account or require explicit user confirmation before any booking is created. If you cannot verify the endpoint or provenance, treat this skill as higher-risk and avoid sending real PII through it.

uook plumuer

Book plumber services through Lokuli's MCP server.

MCP Endpoint

https://lokuli.com/mcp/sse

Transport: SSE | JSON-RPC 2.0 | POST requests

Tools

search

{
  "method": "tools/call",
  "params": {
    "name": "search",
    "arguments": {
      "query": "plumber",
      "zipCode": "90640",
      "maxResults": 20
    }
  }
}

check_availability

{
  "method": "tools/call",
  "params": {
    "name": "check_availability",
    "arguments": {
      "providerId": "xxx",
      "serviceId": "yyy",
      "date": "2025-02-10"
    }
  }
}

create_booking

{
  "method": "tools/call",
  "params": {
    "name": "create_booking",
    "arguments": {
      "providerId": "xxx",
      "serviceId": "yyy",
      "timeSlot": "2025-02-10T14:00:00-08:00",
      "customerName": "John Doe",
      "customerEmail": "[e-mail]",
      "customerPhone": "[phone]"
    }
  }
}