Book Haircut

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:24 AM UTC
• Version: 1.0.1

Overview

This haircut-booking skill is coherent, but it can send a customer's contact details to Lokuli and create a booking without requiring final confirmation.

Review this skill before installing. It appears designed for legitimate haircut booking through Lokuli, but you should only use it if you are comfortable with your name, email, phone number, appointment choice, and provider details being sent to Lokuli, and you should require the agent to show all booking details and ask for explicit approval before creating an appointment.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

other

Warning

• Location: SKILL.md:48
• Finding: External Disclosure of Personal Data Without an Explicit Consent Gate## Vulnerability Details **File Location**: `SKILL.md`, lines 48–63 **Vulnerability Type**: Personal data disclosure to an external service **Risk Level**: Medium The skill defines a booking operation that sends a customer's name, email address, and telephone number to the external Lokuli MCP endpoint at `https://lokuli.com/mcp/sse`. It does not instruct the agent to obtain explicit confirmation immediately before transmitting this information or creating the booking. **Complete relevant code snippet:** ```markdown ### create_booking ```json { "method": "tools/call", "params": { "name": "create_booking", "arguments": { "providerId": "xxx", "serviceId": "yyy", "timeSlot": "2025-02-10T14:00:00-08:00", "customerName": "John Doe", "customerEmail": "[e-mail]", "customerPhone": "[phone]" } } } ``` ``` ### Technical Analysis The `create_booking` operation causes an external side effect and transmits personally identifiable information to a third-party endpoint. Although these fields are relevant to making an appointment, the skill contains no required confirmation step covering the selected provider, service, time, price, destination service, or personal fields to be disclosed. Consequently, an agent could interpret a general request such as “book a haircut” as sufficient authorization to submit the booking. The issue is not evidence of malicious endpoint behavior; it is an authorization and privacy-control weakness in the skill instructions. ### Attack Path 1. A user asks the agent to find or book a haircut. 2. The agent invokes `search` and `check_availability`. 3. The agent obtains or already possesses the user's name, email address, and telephone number. 4. Because the skill specifies no mandatory final confirmation, the agent invokes `create_booking` without presenting the complete transaction to the user. 5. The user's person ...[truncated 632 chars]
• Remediation: ## Remediation Suggestions 1. Require a final, explicit user confirmation immediately before invoking `create_booking`. 2. Present the provider, service, date and time, total price and cancellation terms when available, external recipient domain, and every personal field that will be transmitted. 3. Clearly distinguish searching and availability checks from the irreversible or side-effecting booking operation. 4. Send only fields required by the booking provider and avoid reusing personal information from unrelated context. 5. Require the agent to stop if the user declines, provides ambiguous approval, or changes any transaction detail after confirmation. 6. Document the external service's privacy, retention, authentication, and error-handling expectations. 7. Return a booking receipt and provide cancellation instructions after a successful request.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill facilitates sending customer name, email, phone number, and appointment details to an external service endpoint but does not warn the user that their personal data will be transmitted to Lokuli. This lack of disclosure undermines informed consent and can lead to unauthorized sharing of sensitive personal information with a third party.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger description is broad enough to activate on general haircut-related requests without clearly constraining when the skill should be used or requiring confirmation before external actions. In a booking skill that connects to a third-party MCP service, ambiguous activation increases the chance of unintended tool use, premature data collection, or accidental booking flow initiation.

Static analysis

No suspicious patterns detected.