Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent eyebrow-service booking helper, but it can create third-party bookings with personal contact details without explicit consent or confirmation instructions.
Review before installing. Use this skill only if you are comfortable with an agent contacting Lokuli to search and book services, and make sure the agent asks before sending your name, email, phone number, and final booking choice.
The trigger language is broad enough to activate on a wide range of generic 'eyebrows' requests, which can cause the skill to run when the user did not clearly intend to search or book through this third-party service. In a booking skill, over-triggering is security-relevant because it can prematurely steer users into data collection and external transmission workflows.
The skill includes a booking flow that collects customer name, email, and phone number for transmission to an external MCP endpoint, but it does not warn the user or require clear consent before gathering and sending that personal information. This increases privacy and compliance risk, especially because the skill directly facilitates disclosure of contact data to a third-party service.
No suspicious patterns detected.
