Security audit
Security checks for vulnerabilities and agentic risk
This is a simple booking skill that uses an external Lokuli MCP service as disclosed, with privacy and confirmation cautions but no evidence of hidden or malicious behavior.
Install only if you are comfortable using Lokuli as the booking provider. Before any booking is created, confirm the provider, time, and exact personal contact details being sent, especially because chiropractor appointments can reveal health-related preferences.
The skill collects and sends personal contact information such as name, email, and phone number to an external Lokuli MCP endpoint, but the description does not warn the user about this data transfer. Without clear disclosure and consent, users may unknowingly provide sensitive personal data to a third party, creating privacy, compliance, and trust risks.
The trigger text is broad enough to activate on general chiropractor-related requests, not just explicit booking intent. In a skill that can search providers and create bookings through an external MCP service, over-broad invocation can cause unintended tool use, unnecessary transmission of user context, or accidental progression toward booking actions the user did not clearly request.
No suspicious patterns detected.
