Book Tree Service

Book tree-service services through Lokuli MCP. Use when user needs to find and book tree-service. Triggers on requests like "book a tree-service", "find tree-service near me", or any tree-service service request.

Security Scan

The skill's instructions are broadly consistent with a tree-service booking helper, but missing provenance and authentication details make it unclear whether it will behave as claimed or where user data would go.

Purpose & Capability

Name and description match the instructions: SKILL.md contains JSON-RPC calls (search, check_availability, create_booking) to an external MCP endpoint (https://lokuli.com/mcp/sse) which is coherent with a booking workflow. However, the skill lists no owner/homepage/source and supplies example provider/service IDs and customer data but no mechanism for obtaining providerId/serviceId or authenticating to Lokuli. For a real booking integration, some form of credentials or onboarding info is normally required; their absence is notable.

Instruction Scope

Instructions include concrete JSON-RPC payloads and an external endpoint but do not describe authentication, rate-limiting, error handling, or how to obtain/replace example data (zip code, providerId, customer fields). There are no instructions requiring explicit user consent before sending personal data; in practice an agent following this could attempt to send a user's PII to an external service without safeguards.

Install Mechanism

Instruction-only skill with no install spec and no code files — low risk from local code execution or disk persistence. Nothing is downloaded or written during install because there is no install mechanism.

Credentials

The skill requests no environment variables or credentials, which reduces immediate risk. At the same time, a booking integration typically requires authentication (API key, OAuth token, or similar); the absence of any declared credential is unexpected and leaves unclear how the MCP endpoint expects requests to be authorized.

Persistence & Privilege

always:false and no special config paths or install behavior. The skill is user-invocable and can be called autonomously by the agent (platform default), which is expected for useful skills. There is no request to modify other skills or system-wide settings.

What to consider before installing

This skill appears to implement a booking workflow but lacks provenance and any authentication details. Before installing or using it: 1) Verify the Lokuli domain and the skill author (is lokuli.com legitimate and related to the developer?). 2) Ask how the agent will authenticate to the MCP (API key/OAuth) — do not let it send real PII until you confirm an auth/token mechanism and a privacy policy. 3) Confirm where providerId/serviceId values come from and that the agent will ask you for explicit consent before sending your name, email, or phone. 4) If you want to test, use dummy data and monitor outgoing network requests in a safe environment. If the publisher can provide an owner/homepage, documented auth flow, and privacy terms, re-evaluate — that information would likely move the assessment toward benign.

uook tree service

Book tree-service services through Lokuli's MCP server.

MCP Endpoint

https://lokuli.com/mcp/sse

Transport: SSE | JSON-RPC 2.0 | POST requests

Tools

search

{
  "method": "tools/call",
  "params": {
    "name": "search",
    "arguments": {
      "query": "tree-service",
      "zipCode": "90640",
      "maxResults": 20
    }
  }
}

check_availability

{
  "method": "tools/call",
  "params": {
    "name": "check_availability",
    "arguments": {
      "providerId": "xxx",
      "serviceId": "yyy",
      "date": "2025-02-10"
    }
  }
}

create_booking

{
  "method": "tools/call",
  "params": {
    "name": "create_booking",
    "arguments": {
      "providerId": "xxx",
      "serviceId": "yyy",
      "timeSlot": "2025-02-10T14:00:00-08:00",
      "customerName": "John Doe",
      "customerEmail": "[e-mail]",
      "customerPhone": "[phone]"
    }
  }
}