Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Lokuli Booking
v0.1.0Book real-world services through Lokuli MCP. Use when user needs to find, check availability, or book local services like plumbers, electricians, cleaners, mechanics, barbers, personal trainers, etc. Triggers on requests like "book me a haircut", "find a plumber near me", "I need a smog check", "schedule a massage", or any local service request. 75+ service categories available.
⭐ 0· 1.2k·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name/description (book local services) match the SKILL.md: search, fetch, check availability, create bookings, and return Stripe checkout URLs for payment. The declared capabilities align with the stated purpose.
Instruction Scope
Instructions are narrowly scoped to searching providers, fetching details, checking availability, and creating bookings. They explicitly require collecting user name, email, phone, and optionally ZIP from context — which is appropriate for booking but does involve personal data. No instructions ask the agent to read unrelated files or system secrets.
Install Mechanism
Instruction-only skill with no install spec or code files — minimal surface area and no disk writes. This is the lowest-risk install pattern.
Credentials
The SKILL.md talks to Lokuli's MCP endpoint and generates Stripe checkout links but the skill declares no required environment variables or credentials. That can be fine if the platform provides the necessary tool integrations/auth; otherwise it is an ambiguity to resolve. The personal data requested for bookings (name, email, phone, ZIP) is proportionate to the task but worth noting from a privacy perspective.
Persistence & Privilege
Skill does not request always:true and does not declare any persistent system modifications. Model invocation is allowed (platform default), which is expected for a user-invokable booking skill.
Assessment
This skill appears to do what it says (find providers, check availability, create bookings and hand you a Stripe checkout link). Before installing: 1) Note the package has no homepage and an unknown source/owner — verify Lokuli's legitimacy outside this registry if possible. 2) Confirm how the platform will authenticate to lokuli.com and whether any hidden credentials are required (SKILL.md declares none). 3) Expect the skill to ask for personal info (name, email, phone, ZIP) to make bookings; only provide contact details you’re comfortable sharing. 4) Payment happens via a Stripe checkout URL — you will complete payment off the agent; never paste card numbers into chat. 5) If you need stronger assurance, ask the publisher for a homepage or integration docs that explain authentication, data handling, and retention.Like a lobster shell, security has layers — review code before you run it.
latestvk975519ahkdwde34xsqszpnkdn80k080
License
MIT-0
Free to use, modify, and redistribute. No attribution required.