ClawHub
Back to skill

Security audit

Book Color

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward Lokuli booking skill with disclosed external booking tools, though users should confirm before sharing contact details.

Install this only if you intend to use Lokuli for color-service appointment search and booking. Before creating a booking, verify the provider, time, and contact details, and make sure you are comfortable sending your name, email, and phone number to the external booking service.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
88% confidence
Finding
The trigger text is broad enough to activate on generic 'color' requests, which could cause the assistant to invoke this external booking workflow when the user did not intend to book a salon service. In a skill that connects to a third-party MCP endpoint and can later collect personal details for booking, over-triggering increases the risk of unintended data sharing or confusing users into an external transaction flow.

Missing User Warnings

High
Confidence
97% confidence
Finding
The skill includes a booking operation that sends customer name, email, and phone number to an external service, but the description provides no warning or consent step before transmitting that personal information. Because this skill is specifically designed to complete third-party bookings, the lack of disclosure is especially risky: users may not realize their contact details are being shared outside the assistant environment.

VirusTotal

61/61 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.