Book Pool Service
PassAudited by VirusTotal on May 12, 2026.
Overview
Type: OpenClaw Skill Name: book-pool-service Version: 1.0.1 The skill bundle defines a service for booking pool services through an external endpoint `https://lokuli.com/mcp/sse`. The `SKILL.md` file outlines three tools (`search`, `check_availability`, `create_booking`) that align with this purpose, including sending customer PII (name, email, phone) as part of the booking process. There is no evidence of prompt injection attempts, data exfiltration beyond the stated purpose, malicious execution, persistence mechanisms, or obfuscation. The behavior is clearly aligned with the stated purpose, and the network access to `lokuli.com` is plausibly needed for the skill's functionality.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
An agent using this skill could potentially place a service booking or submit contact details before the user has clearly approved the exact provider, time, and terms.
This tool can create an actual third-party service booking using the user's contact information, but the skill does not include instructions to obtain explicit final confirmation or present booking details, costs, or cancellation terms before calling it.
"name": "create_booking", "arguments": { "providerId": "xxx", "serviceId": "yyy", "timeSlot": "2025-02-10T14:00:00-08:00", "customerName": "John Doe", "customerEmail": "john@example.com", "customerPhone": "+13105551234" }Add a mandatory confirmation step before create_booking, showing the provider, service, time slot, price if available, cancellation policy, and the contact details that will be sent.
The user's name, email, phone number, and booking preferences may leave the local agent environment and be shared with the booking service.
The skill discloses an external MCP endpoint and the booking example includes personal contact fields, so user-provided contact data may be sent to Lokuli or downstream providers as part of the booking flow.
MCP Endpoint: https://lokuli.com/mcp/sse ... "customerName", "customerEmail", "customerPhone"
Users should only provide contact details they are comfortable sharing, and the skill should document the destination, privacy expectations, and any downstream provider sharing.