v1.0.1

Book Yoga

BenignClawScan verdict for this skill. Analyzed May 1, 2026, 5:23 AM.

Analysis

This skill is purpose-aligned for finding and booking yoga through Lokuli, but users should notice that it can send contact details to an external MCP service and create a booking.

GuidanceInstall only if you are comfortable using Lokuli’s external MCP service for yoga search and booking. Before any booking is created, verify the provider, service, time slot, and contact details, and avoid sharing unnecessary personal information.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Tool Misuse and Exploitation

SeverityLowConfidenceHighStatusNote

SKILL.md

"name": "create_booking", "arguments": { "providerId": "xxx", "serviceId": "yyy", "timeSlot": "2025-02-10T14:00:00-08:00", "customerName": "John Doe"

The skill documents a tool that can create a booking. That is expected for a yoga-booking skill, but it is a user-impacting action that should be confirmed before use.

User impactIf used without careful confirmation, the agent could create an unwanted yoga booking with the wrong provider, service, time, or contact details.

RecommendationConfirm the provider, service, date/time, customer name, email, and phone number with the user before calling the booking tool.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Insecure Inter-Agent Communication

SeverityLowConfidenceHighStatusNote

SKILL.md

https://lokuli.com/mcp/sse ... "customerEmail": "john@example.com", "customerPhone": "+13105551234"

The skill uses a remote MCP endpoint and its booking example includes customer contact details, indicating that personal information may be sent to Lokuli to complete bookings.

User impactThe external service may receive search details such as location and booking details such as name, email, and phone number.

RecommendationOnly provide information needed for the booking and ensure the user is comfortable sharing those details with Lokuli.