Book Smog
v1.0.0Book smog check appointments through Lokuli MCP. Use when user needs a smog check, emissions test, or vehicle inspection. Triggers on requests like "I need a smog check", "book smog test", "emissions inspection", "DMV smog requirement", or any smog-related request.
⭐ 0· 1.3k·0 current·0 all-time
byLokuli@edwardrodriguez703-design
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description, workflow steps (search → check availability → create booking) and the listed tools align with a booking/appointment skill for smog checks. No unrelated binaries, env vars, or config paths are requested.
Instruction Scope
The SKILL.md explicitly instructs using Lokuli's MCP endpoint and provides JSON-RPC examples for search, check_availability, and create_booking. It does not instruct reading local files or unrelated environment variables. However, it instructs transmitting customer PII (name, email, phone) to an external endpoint and provides no guidance on consent, data minimization, or error handling — this is noteworthy and should be validated with the service owner.
Install Mechanism
This is instruction-only (no install spec, no code files). That minimizes on-disk risk; nothing is downloaded or installed by the skill itself.
Credentials
The skill declares no required credentials or environment variables, yet it points to an external MCP API for creating bookings. Most booking APIs require authentication (API keys, tokens) or some verification; the absence of any declared credential requirement is an omission that could mean the instructions are incomplete or that the skill would attempt unauthenticated calls. Also, transmitting PII without specifying privacy or auth is a proportionality/privacy concern.
Persistence & Privilege
The skill is not always-enabled, does not request elevated or persistent system privileges, and does not modify other skills or system settings. Autonomous invocation is allowed (platform default) but not combined with other privileged requests.
What to consider before installing
Before installing or invoking this skill: (1) Verify lokuli.com is the legitimate service you expect and find official API docs or a homepage that describe the MCP endpoint and required auth. (2) Confirm how authentication is supposed to work — the SKILL.md does not declare any API key/token requirement, which is unusual for booking APIs. (3) Be aware the skill will transmit personal data (name, email, phone) to an external endpoint — ensure you have user consent and are comfortable with the service's privacy practices. (4) If possible, test using non-sensitive/dummy data to observe behavior and error handling. (5) If you cannot validate the endpoint's provenance or required credentials, avoid giving the skill real user PII or enabling it for autonomous invocation.Like a lobster shell, security has layers — review code before you run it.
latestvk97efs478cb3jwtj7ejw3htp3980ngw6
License
MIT-0
Free to use, modify, and redistribute. No attribution required.