Security audit
Security checks for vulnerabilities and agentic risk
This skill is a simple booking helper that discloses its external Lokuli MCP endpoint and expected booking data, with privacy and trigger-scope cautions users should understand.
Before installing, understand that booking uses Lokuli's external MCP service and may send your name, email, phone number, selected provider, service, and appointment time. Use it for actual appointment search or booking, and confirm details before allowing a booking to be created.
The skill facilitates sending personal contact data such as name, email, and phone number to an external MCP endpoint, but the description does not warn users that this transfer occurs. In a booking context, users may disclose sensitive personal information without informed consent, creating privacy, compliance, and trust risks if data is transmitted unexpectedly or to an unvetted third party.
The trigger language is broad enough to activate on almost any facial-related request, not just explicit booking intent. That can cause the agent to route users into an external booking workflow prematurely, increasing the chance of unintended third-party data sharing or unwanted transactional actions.
No suspicious patterns detected.
