Book Roofing

PassAudited by ClawScan on May 10, 2026.

Overview

This instruction-only skill appears to do what it says—use Lokuli’s external MCP service to find and book roofing services—but users should confirm booking details before sharing contact information.

This looks reasonable for booking roofing through Lokuli. Use it only when you intend to contact or book a roofing provider, and make sure the agent confirms all booking details and gets your consent before sending your contact information.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

If used without careful confirmation, the agent could book an unwanted appointment or share contact details with the service provider.

Why it was flagged

This disclosed tool is central to the booking purpose, but it can create an external service appointment using the user's contact details.

Skill content

"name": "create_booking" ... "timeSlot": "2025-02-10T14:00:00-08:00", "customerName": "John Doe", "customerEmail": "john@example.com", "customerPhone": "+13105551234"

Recommendation

Before calling create_booking, confirm the selected provider, service, date/time, price or estimate, cancellation policy, and the user's consent to share their name, email, and phone number.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Booking information and contact details may be sent to Lokuli or downstream roofing providers.

Why it was flagged

The skill directs the agent to use an external MCP endpoint and the booking example includes personal contact information.

Skill content

MCP Endpoint ... https://lokuli.com/mcp/sse ... "customerEmail": "john@example.com", "customerPhone": "+13105551234"

Recommendation

Only provide the minimum information needed for the booking and avoid sharing extra sensitive details unless the user explicitly agrees.