v1.0.0

Local Booking

BenignClawScan verdict for this skill. Analyzed May 1, 2026, 5:23 AM.

Analysis

The skill is coherent for booking local services, but users should notice that it contacts a third-party MCP service and can create real-world bookings after confirmation.

GuidanceThis skill appears purpose-aligned for finding and booking local services. Before installing or using it, be aware that it relies on Lokuli's external MCP endpoint and may share your contact information and ZIP code to create bookings. Do not approve a booking until you have checked the provider, price, time, and payment link.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Tool Misuse and Exploitation

SeverityLowConfidenceHighStatusNote

SKILL.md

"Never book without confirmation" — Always get explicit approval

The skill can perform a real-world booking action, but the artifact explicitly requires user confirmation before doing so.

User impactIf used correctly, the agent should not create a booking unless you approve the provider, time, price, and contact details.

RecommendationReview the booking details before approving, especially service provider, time slot, price, cancellation terms, and contact information.

Agentic Supply Chain Vulnerabilities

SeverityInfoConfidenceHighStatusNote

metadata

Source: unknown; Homepage: none

The registry information does not provide a source repository or homepage, so users have limited provenance information for the third-party MCP integration.

User impactYou have less independent information available to verify who operates the booking endpoint or how it handles requests.

RecommendationConsider verifying Lokuli separately before relying on the skill for bookings or sharing personal contact information.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Insecure Inter-Agent Communication

SeverityLowConfidenceHighStatusNote

SKILL.md

"https://lokuli.com/mcp/sse" and "customerName", "customerEmail", "customerPhone"

The skill routes booking requests through a third-party MCP endpoint and documents sending customer contact details for booking creation.

User impactYour name, email, phone number, ZIP code, and requested service details may be sent to Lokuli's MCP service and relevant providers.

RecommendationOnly provide contact details you are comfortable sharing with the booking service and confirm that the provider is legitimate before proceeding.