Book Windshield

Book windshield services through Lokuli MCP. Use when user needs to find and book windshield. Triggers on requests like "book a windshield", "find windshield near me", or any windshield service request.

Security Scan

The skill appears to do what it claims (book windshield services) but it will transmit user personal data to an external Lokuli MCP endpoint (source/homepage unknown) with no declared authentication or provenance — this mismatch and lack of provenance warrant caution.

Purpose & Capability

Name/description align with the instructions: the SKILL.md defines JSON-RPC calls (search, check_availability, create_booking) against Lokuli's MCP endpoint to find and book windshield services. The fields and operations are consistent with a booking integration.

Instruction Scope

The instructions direct the agent to call an external endpoint (https://lokuli.com/mcp/sse) and to submit customer PII (name, email, phone, timeslots). The SKILL.md does not require or document any authentication, consent steps, or privacy safeguards, and it contains hard-coded example payloads (zipcode 90640, sample customer) rather than explicit guidance to prompt the user for location/contact data. This means the agent will transmit user data externally if invoked.

Install Mechanism

Instruction-only skill with no install spec and no code files; nothing is written to disk by the skill itself. Lowest install risk.

Credentials

The skill declares no required environment variables or credentials, yet its runtime behavior includes sending sensitive user data to a third-party endpoint. Absence of any declared API key or auth suggests anonymous access or that credentials would be supplied elsewhere — this mismatch (no auth declared but networked PII transmission) is a proportionality concern. Also the skill's source and homepage are unknown, so you cannot verify Lokuli's trustworthiness.

Persistence & Privilege

always is false and there are no indications the skill modifies other skills or system-wide settings. Autonomous invocation is permitted by default but not combined with other elevated privileges.

What to consider before installing

This skill will send user-identifying information (name, email, phone, location, appointment time) to https://lokuli.com without declaring any authentication or a homepage/source you can inspect. Before installing: (1) confirm you trust Lokuli and have reviewed its privacy/security practices; (2) if you install, require the skill to explicitly prompt for and show what personal data will be sent and obtain user consent; (3) avoid providing sensitive contact info until you verify the endpoint (or use a throwaway email/phone); (4) consider disabling autonomous invocation for this skill so it cannot act without explicit user approval; and (5) if you need stronger guarantees, ask the publisher for an official homepage, API docs, or an API key/auth mechanism. If you cannot verify the service provenance, treat this skill as potentially risky and do not use it with real personal data.

uook windshield

Book windshield services through Lokuli's MCP server.

MCP Endpoint

https://lokuli.com/mcp/sse

Transport: SSE | JSON-RPC 2.0 | POST requests

Tools

search

{
  "method": "tools/call",
  "params": {
    "name": "search",
    "arguments": {
      "query": "windshield",
      "zipCode": "90640",
      "maxResults": 20
    }
  }
}

check_availability

{
  "method": "tools/call",
  "params": {
    "name": "check_availability",
    "arguments": {
      "providerId": "xxx",
      "serviceId": "yyy",
      "date": "2025-02-10"
    }
  }
}

create_booking

{
  "method": "tools/call",
  "params": {
    "name": "create_booking",
    "arguments": {
      "providerId": "xxx",
      "serviceId": "yyy",
      "timeSlot": "2025-02-10T14:00:00-08:00",
      "customerName": "John Doe",
      "customerEmail": "[e-mail]",
      "customerPhone": "[phone]"
    }
  }
}