v1.0.1

Book Wedding

ReviewClawScan verdict for this skill. Analyzed May 1, 2026, 5:24 AM.

Analysis

Review recommended: the skill is aligned with wedding booking, but it can create real bookings through a remote service and send customer contact details without documented confirmation safeguards.

GuidanceBefore installing or using this skill, verify that Lokuli is the wedding-booking service you intend to use, and do not allow create_booking until you have manually confirmed all booking details, costs, cancellation terms, and the contact information that will be sent to the remote endpoint.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Tool Misuse and Exploitation

SeverityMediumConfidenceHighStatusConcern

SKILL.md

"name": "create_booking" ... "timeSlot": "2025-02-10T14:00:00-08:00", "customerName": "John Doe", "customerEmail": "john@example.com", "customerPhone": "+13105551234"

The artifact documents a tool call that can create a booking using customer contact details, but it does not include an explicit user-confirmation or cancellation/rollback requirement before that action.

User impactThe agent could create an unwanted vendor booking or reservation if it calls the booking tool before the user has confirmed the exact details and any obligations.

RecommendationRequire explicit user confirmation of the vendor, service, date, time, contact details, price, and cancellation terms before allowing any create_booking call.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Insecure Inter-Agent Communication

SeverityLowConfidenceHighStatusNote

SKILL.md

## MCP Endpoint
```https://lokuli.com/mcp/sse``` ... "customerEmail": "john@example.com", "customerPhone": "+13105551234"

The skill communicates with a remote MCP endpoint and the booking example includes personal contact fields, so user-provided contact data would be sent to that external service.

User impactYour name, email, phone number, and booking preferences may be shared with Lokuli's remote MCP service as part of the booking workflow.

RecommendationUse the skill only with information you are comfortable sharing with Lokuli, and verify the service identity and privacy expectations before booking.