Security audit
Security checks for vulnerabilities and agentic risk
This skill is a narrow bartender-booking integration, but it can send personal contact details to an external service and create a booking without explicit consent or confirmation instructions.
Review this skill before installing if you are comfortable with a third-party Lokuli MCP service receiving booking details such as your name, email, phone number, zip code, date, and selected provider. Only use it when you intend to make a bartender booking, and require explicit confirmation before any create_booking call.
The skill facilitates transmission of personal contact data such as name, email, and phone number to an external MCP endpoint, but the description provides no warning or consent cue to the user. This creates a meaningful privacy and data-sharing risk because users may not realize their PII will be sent off-platform to complete a booking.
The trigger language is broad enough to activate on generic requests like finding or booking a bartender without clear scoping, confirmation, or guardrails. That can cause the skill to engage in situations the user did not explicitly intend, increasing the chance of unintended third-party lookups or booking flows involving external services.
No suspicious patterns detected.
