Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward car-wash search and booking helper that uses a disclosed Lokuli MCP endpoint, with privacy and confirmation cautions but no evidence of hidden or malicious behavior.
Before installing, understand that booking through this skill uses Lokuli's external MCP service and may require sharing your name, email, and phone number. Confirm provider, service, time, and contact details before allowing any booking request to be sent.
The activation text is broad enough to trigger on generic car-wash requests without clearly constraining when the skill should be invoked or whether user confirmation is needed before using an external booking service. That increases the chance of over-invocation and unintended routing of user requests into a workflow that may search or book through a third-party MCP endpoint.
The skill documents collection and transmission of customerName, customerEmail, and customerPhone to an external MCP service but does not warn the user that their personal contact data will be sent off-platform. This creates a meaningful privacy and consent risk because users may not realize that external processing is involved before sensitive personal information is shared.
No suspicious patterns detected.
