Book Videographer

PassAudited by ClawScan on May 10, 2026.

Overview

This is a coherent booking skill, but it can contact an external Lokuli MCP service, send customer contact details, and create a real booking, so users should confirm details before use.

This skill appears benign and purpose-aligned for booking videographers. Before using it, confirm the exact provider, service, date/time, and contact information, and only proceed when you are comfortable sending those details to Lokuli's external MCP service.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The agent may be able to submit a booking request to a third-party service if the user provides booking details.

Why it was flagged

The skill documents a tool call that can create a booking with a provider. This is directly aligned with the skill purpose, but it is a real-world action that should be confirmed by the user.

Skill content
"name": "create_booking", "arguments": { "providerId": "xxx", "serviceId": "yyy", "timeSlot": "2025-02-10T14:00:00-08:00", "customerName": "John Doe"
Recommendation

Before allowing the booking call, confirm the selected provider, service, date/time, contact details, price or cancellation terms if available, and that the user wants to proceed.

What this means

Name, email, phone number, and booking time may be transmitted to Lokuli's MCP service when creating a booking.

Why it was flagged

The skill discloses a remote MCP endpoint and example booking fields containing customer contact information. This is expected for booking services, but users should understand that this data is sent to the external provider.

Skill content
https://lokuli.com/mcp/sse ... "customerEmail": "john@example.com", "customerPhone": "+13105551234"
Recommendation

Share only the information needed to book the service, and avoid submitting sensitive personal details unless necessary.

What this means

Users have less provenance information to verify who maintains the skill and whether it is officially associated with the named service.

Why it was flagged

The registry context does not provide a source repository or homepage for independent verification of the skill or provider relationship.

Skill content
Source: unknown; Homepage: none
Recommendation

If the booking involves payment, contracts, or sensitive personal details, verify the provider and endpoint independently before proceeding.