Book Windshield

PassAudited by ClawScan on May 1, 2026.

Overview

This instruction-only skill is coherent for finding and booking windshield services, but users should notice that it can send contact details to an external MCP service and create a booking.

This skill appears safe to install as an instruction-only integration, but treat actual booking as a confirmed action: review the selected provider, appointment time, and contact information before allowing the booking request.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

If used without confirmation, the agent could create an appointment with the wrong provider, time, or contact details.

Why it was flagged

The skill includes a tool call that can create a service booking using the user's contact details. This is aligned with the skill purpose, but it is an action the user should explicitly confirm.

Skill content

"name": "create_booking", "arguments": { "providerId": "xxx", "serviceId": "yyy", "timeSlot": "2025-02-10T14:00:00-08:00", "customerName": "John Doe", "customerEmail": "john@example.com", "customerPhone": "+13105551234" }

Recommendation

Confirm the provider, service, date/time, contact information, and any costs or cancellation terms before calling create_booking.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Using the booking flow may send personal contact information to Lokuli or its service providers.

Why it was flagged

The skill communicates with an external MCP endpoint, and the documented booking request includes customer name, email, and phone number.

Skill content

MCP Endpoint

```
https://lokuli.com/mcp/sse
```

Transport: SSE | JSON-RPC 2.0 | POST requests

Recommendation

Only provide the contact details needed for the booking, and avoid sharing unnecessary personal information.