Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent HVAC booking helper, but it can send personal contact details to an external service and create real bookings without clearly requiring user confirmation.
Review this skill before installing. It is not showing hidden code or destructive behavior, but you should only use it when you intentionally want Lokuli to search or book HVAC service, and you should confirm provider, service, time, and the personal details being sent before any booking is created.
The skill instructs use of an external MCP endpoint but does not warn that user data such as ZIP code, name, email, and phone may be transmitted to a third-party service. Because this is a booking workflow tied to an external endpoint, the omission can lead to uninformed disclosure of personal contact and location data.
The trigger condition is broad enough to activate on essentially any HVAC-related request, which can cause the agent to route users into an external booking flow without first confirming intent. In this skill, that increases the chance of premature use of third-party tools and unnecessary disclosure of location or booking-related data.
The create_booking flow performs an external reservation action but the skill does not require a user-facing warning or explicit confirmation immediately before the booking is created. That can result in unintended real-world actions, including appointments made with third-party providers using the user's personal details.
No suspicious patterns detected.
