Security audit

Book Acupuncture

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward acupuncture booking connector to Lokuli, but users should know it can send appointment and contact details to that external service.

Install this only if you are comfortable using Lokuli as the external booking service. Before creating a booking, confirm the provider, service, appointment time, and the exact name, email, and phone number that will be sent.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The activation text is broad enough to trigger on general acupuncture-related requests, which can cause the skill to activate in situations where the user did not clearly intend to initiate a third-party booking workflow. In this context, unintended activation is risky because the skill is connected to an external booking service and may steer the conversation toward collecting and transmitting personal data.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The skill facilitates sending personal contact information such as name, email, and phone number to an external MCP service, but it does not warn the user that this data will leave the platform. This creates a meaningful privacy and consent risk, especially in a medical-adjacent context where booking acupuncture may reveal sensitive health-related preferences or treatment-seeking behavior.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.