Book Waxing

PassAudited by ClawScan on May 10, 2026.

Overview

This skill appears to do what it says—help search for and book waxing appointments through Lokuli—though booking shares contact details with an external service.

This looks safe to install as an instruction-only booking helper, but before creating a booking, verify the provider, service, time, and contact details, and only proceed if you trust Lokuli with that information.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

The agent could create an actual appointment using the user's contact information if the workflow is not carefully confirmed.

Why it was flagged

The skill exposes a state-changing booking action. This is aligned with the stated purpose, but it should be used only after the user confirms the exact booking details.

Skill content

"name": "create_booking", "arguments": { "providerId": "xxx", "serviceId": "yyy", "timeSlot": "2025-02-10T14:00:00-08:00", "customerName": "John Doe", "customerEmail": "john@example.com", "customerPhone": "+13105551234" }

Recommendation

Confirm the provider, service, date/time, name, email, and phone number before allowing the booking call.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Searches and booking details, including contact information when booking, may be sent to Lokuli's remote MCP service.

Why it was flagged

The skill communicates with an external MCP endpoint. That is expected for a booking integration, but the artifact does not provide additional privacy, retention, or trust-boundary details.

Skill content

https://lokuli.com/mcp/sse ... Transport: SSE | JSON-RPC 2.0 | POST requests

Recommendation

Use the skill only if you are comfortable sharing the necessary appointment and contact details with Lokuli.