Security audit

Book Handyman

Security checks for vulnerabilities and agentic risk

Overview

This skill appears purpose-built for booking handyman services, but it can send personal contact details to an external Lokuli booking service without explicit consent or confirmation instructions.

Install only if you are comfortable using Lokuli as the external booking service. Before any booking, the agent should show the provider, time slot, and exact contact details to be shared, then wait for your explicit confirmation.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

High

Confidence: 97% confidence
Finding: The skill includes a create_booking flow that transmits personally identifiable information such as customer name, email, and phone number to an external MCP endpoint, but the skill description provides no warning or consent guidance. This is dangerous because users may not realize their contact data will be sent to a third-party service, creating privacy, compliance, and trust risks if data is shared without explicit informed consent.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The trigger text is broad enough to activate on generic phrases like 'find handyman near me' or 'any handyman service request,' which can cause the skill to engage without clear user intent to use this specific external booking workflow. Because the skill can lead into provider search and booking actions, over-triggering increases the chance of unintended external service use and unnecessary exposure of user context.

Static analysis

No suspicious patterns detected.