Book Spa
ReviewAudited by ClawScan on May 10, 2026.
Overview
The skill is coherent for booking spa appointments, but it can create real-world bookings and send contact details to an external MCP service without instructions requiring explicit user confirmation.
Use this skill only after confirming the exact spa, service, appointment time, price or cancellation terms, and contact information. Treat the final booking step as a real commitment and verify you are comfortable sharing your contact details with the Lokuli MCP service.
Findings (2)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
An agent could potentially create an unwanted spa appointment or send incorrect contact information if it treats a vague request as permission to book.
The skill documents a mutating booking operation that can schedule an appointment and send contact details, but the artifact does not instruct the agent to obtain explicit confirmation or verify terms before calling it.
"name": "create_booking", "arguments": { "providerId": "xxx", "serviceId": "yyy", "timeSlot": "2025-02-10T14:00:00-08:00", "customerName": "John Doe", "customerEmail": "john@example.com", "customerPhone": "+13105551234" }Require explicit user confirmation of provider, service, date, time, price, cancellation policy, and contact details before using create_booking.
Your name, email, phone number, and appointment preferences may be shared with Lokuli or its spa providers as part of booking.
The skill routes booking requests through an external MCP endpoint and the booking payload includes personal contact information.
MCP Endpoint: https://lokuli.com/mcp/sse ... "customerName": "John Doe", "customerEmail": "john@example.com", "customerPhone": "+13105551234"
Only provide the minimum contact information needed, and confirm that you trust the Lokuli MCP service before booking.