v1.0.1

Book Web Developer

BenignClawScan verdict for this skill. Analyzed May 1, 2026, 5:23 AM.

Analysis

This instruction-only skill appears aligned with booking a web developer, but it uses an external Lokuli MCP service that may create a booking and send customer contact details.

GuidanceThis skill looks reasonable for finding and booking web-developer services, but treat booking as a real commitment: verify the provider, time, and terms, and only share contact details after you are ready for Lokuli to receive them.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Tool Misuse and Exploitation

SeverityLowConfidenceHighStatusNote

SKILL.md

"name": "create_booking" ... "timeSlot": "2025-02-10T14:00:00-08:00"

The skill documents a tool call that can create an actual service booking, which is expected for the skill but should be user-confirmed before use.

User impactThe agent could submit a booking request for a provider and time if the user asks it to book.

RecommendationConfirm provider, service, date/time, and any costs or cancellation terms before allowing a booking to be created.

Agentic Supply Chain Vulnerabilities

SeverityInfoConfidenceHighStatusNote

metadata

Source: unknown; Homepage: none

The skill has limited provenance information, though it contains no executable code or install mechanism.

User impactIt may be harder to independently verify who maintains the skill or whether the referenced service is the intended provider.

RecommendationVerify the Lokuli service and skill publisher before relying on it for bookings or sharing personal details.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Insecure Inter-Agent Communication

SeverityLowConfidenceHighStatusNote

SKILL.md

https://lokuli.com/mcp/sse ... "customerName": "John Doe", "customerEmail": "john@example.com", "customerPhone": "+13105551234"

The skill routes booking calls through an external MCP endpoint and includes customer contact information in the booking payload.

User impactYour name, email, phone number, and requested booking time may be sent to Lokuli to complete the booking.

RecommendationOnly provide contact details you are comfortable sharing with the booking provider, and verify the service before submitting personal information.