Book Salon
v1.0.1Book salon services through Lokuli MCP. Use when user needs to find and book salon. Triggers on requests like "book a salon", "find salon near me", or any salon service request.
⭐ 1· 1.4k·0 current·0 all-time
byLokuli@edwardrodriguez703-design
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name and description claim booking salon services via Lokuli MCP; the SKILL.md explicitly targets Lokuli's MCP endpoint and provides RPC examples (search, check_availability, create_booking). The requested capabilities align with the stated purpose.
Instruction Scope
The instructions direct the agent to call an external endpoint (https://lokuli.com/mcp/sse) and to POST JSON-RPC payloads that include personal customer data (name, email, phone, location/zip). There are no instructions about authentication, consent, or data minimization. Opening an SSE connection to a third party and transmitting PII without documented safeguards is a privacy/exfiltration risk.
Install Mechanism
This is an instruction-only skill with no install spec and no code files, so it does not write additional binaries or archives to disk. That minimizes install-time risk.
Credentials
The skill requests no environment variables or credentials (which reduces risk), but it will transmit user-identifying information (contact, phone, email, location) to an external host. The SKILL.md does not declare any required credentials or explain how requests are authenticated or authorized—this lack of proportionality and transparency about who receives and stores user data is concerning.
Persistence & Privilege
always is false and there are no installation changes or requests to modify other agent configs. The skill does not request persistent system privileges in its manifest.
What to consider before installing
This skill appears to perform salon search and booking via Lokuli's MCP endpoint, which can legitimately require sending names, emails, phones, and location. Before installing or using it, verify the upstream service and privacy practices: who runs lokuli.com, is there an owner or homepage, how are requests authenticated, and how is booking/customer data stored and retained? Avoid sending real personal data until you confirm those details; test with placeholder/fake data. If you need stricter guarantees, require an explicit authentication step or written privacy policy, or prefer a skill published by a known vendor. If you decide to proceed, ask the publisher to document the auth flow and data retention, and to minimize the data sent in create_booking calls.Like a lobster shell, security has layers — review code before you run it.
latestvk976xp9700x9c8kh6fmx429zv980m8vp
License
MIT-0
Free to use, modify, and redistribute. No attribution required.