Book Tune Up

PassAudited by ClawScan on May 1, 2026.

Overview

This is a coherent booking skill, but it uses an external MCP service to create appointments and share customer contact details, so users should confirm details before booking.

This skill appears purpose-aligned for finding and booking tune-up services. Before installing or using it, make sure you are comfortable sending your contact details to the external Lokuli MCP endpoint, and require a clear final confirmation before any appointment is created.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI02: Tool Misuse and Exploitation

What this means

The agent could create a real service appointment if the booking tool is used with the user's details.

Why it was flagged

The skill exposes a state-changing booking action that submits appointment details and customer contact information. This is aligned with the stated purpose, but users should explicitly approve the provider, time, and contact details before the action is taken.

Skill content

"name": "create_booking", "arguments": { "providerId": "xxx", "serviceId": "yyy", "timeSlot": "2025-02-10T14:00:00-08:00", "customerName": "John Doe", "customerEmail": "john@example.com", "customerPhone": "+13105551234" }

Recommendation

Confirm the provider, date, time, price or fee terms, and contact information before allowing the agent to create a booking.

Note

ASI07: Insecure Inter-Agent Communication

What this means

Personal contact information and appointment preferences may be sent to Lokuli's MCP service during search or booking.

Why it was flagged

The skill instructs the agent to communicate with an external MCP endpoint. This is disclosed and purpose-aligned, but booking requests may transmit customer name, email, phone number, and scheduling details outside the local agent context.

Skill content

## MCP Endpoint

https://lokuli.com/mcp/sse

Transport: SSE | JSON-RPC 2.0 | POST requests

Recommendation

Only provide contact details you are comfortable sharing with the booking service, and verify the service/provider before confirming a booking.