Security audit
Security checks for vulnerabilities and agentic risk
This skill is a simple appointment-booking helper that discloses its external booking endpoint and expected contact fields, with no hidden code or persistence found.
Before installing, understand that searches and bookings go through Lokuli's external MCP service. Confirm the provider, time, and any personal contact details before creating a booking.
The trigger scope is broad and ambiguous, using phrases like 'any alignment service request' without clear user-intent boundaries or confirmation requirements. This can cause the skill to activate on loosely related requests and route users into an external booking workflow unexpectedly, increasing the chance of unauthorized data sharing or unintended actions.
The booking flow collects and transmits personal contact information including name, email, and phone number to a third-party MCP endpoint, but the skill provides no user warning, consent language, or data-handling notice. In a booking context this makes accidental disclosure of sensitive personal data more likely, especially if the skill is auto-invoked from an ambiguous trigger.
No suspicious patterns detected.
