Book Venue

ReviewAudited by ClawScan on May 10, 2026.

Overview

This venue-booking skill is coherent, but it can send personal contact details and create a booking through an external MCP endpoint without explicit confirmation or cancellation safeguards.

Review before installing. If you use it, ask the agent to show all booking details and wait for your explicit confirmation before creating any booking, and only provide contact information you are comfortable sharing with Lokuli.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Medium

#ASI02: Tool Misuse and Exploitation

What this means

A user could end up with an unintended venue booking or have their contact details sent to the provider if the agent proceeds too aggressively.

Why it was flagged

The skill exposes a booking-creation operation that can place an external reservation and transmit customer contact details, but the artifact does not specify a required final user approval, cancellation check, or other safeguard before calling it.

Skill content

"name": "create_booking", "arguments": { "providerId": "xxx", "serviceId": "yyy", "timeSlot": "2025-02-10T14:00:00-08:00", "customerName": "John Doe", "customerEmail": "john@example.com", "customerPhone": "+13105551234" }

Recommendation

Require an explicit final confirmation before create_booking, display the venue, time, contact details, price/cancellation terms if available, and avoid booking unless the user clearly approves.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Venue preferences, ZIP code, and booking contact information may be shared with Lokuli's MCP service.

Why it was flagged

The skill relies on an external MCP endpoint for venue search and booking. This is disclosed and aligned with the stated purpose, but it means user search details and booking data are sent outside the local agent environment.

Skill content

https://lokuli.com/mcp/sse ... Transport: SSE | JSON-RPC 2.0 | POST requests

Recommendation

Use the skill only when comfortable sharing the necessary booking details with Lokuli, and avoid providing unnecessary personal information.