v1.0.1

Book Tires

BenignClawScan verdict for this skill. Analyzed May 1, 2026, 5:23 AM.

Analysis

This is a coherent instruction-only tire-booking skill, but using it may send contact details to Lokuli and create a real booking.

GuidanceThis skill appears benign and purpose-aligned. Before using it, make sure you are comfortable sharing your contact details with the Lokuli booking endpoint, and ask the agent to confirm the provider, service, date/time, and contact information before creating any booking.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Tool Misuse and Exploitation

SeverityLowConfidenceHighStatusNote

SKILL.md

"name": "create_booking" ... "timeSlot": "2025-02-10T14:00:00-08:00" ... "customerName": "John Doe"

The skill documents a tool that can create an external service booking. This is aligned with the skill's purpose, but it is a real-world action users should confirm.

User impactIf used, the agent may create a tire service appointment using the provided provider, service, time slot, and contact details.

RecommendationConfirm the provider, service, date/time, and customer contact information before allowing a booking call.

Agentic Supply Chain Vulnerabilities

SeverityInfoConfidenceHighStatusNote

metadata

Source: unknown; Homepage: none

The registry metadata does not provide a source repository or homepage, so users have limited provenance information for the skill, although there is no code or install step in this artifact set.

User impactIt may be harder to independently verify who maintains the skill or how the referenced Lokuli service is documented.

RecommendationPrefer using it after verifying that the Lokuli MCP endpoint and skill owner are appropriate for your booking needs.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Insecure Inter-Agent Communication

SeverityLowConfidenceHighStatusNote

SKILL.md

"https://lokuli.com/mcp/sse" ... "customerEmail": "john@example.com", "customerPhone": "+13105551234"

The skill uses an external MCP endpoint and the booking example includes customer contact fields, meaning user contact data may be sent to that service when booking.

User impactYour name, email, and phone number could be shared with Lokuli or downstream booking providers as part of the booking flow.

RecommendationOnly provide contact details you are comfortable sharing with the booking service, and review Lokuli's handling of booking data if privacy is important to you.