Security audit
Security checks for vulnerabilities and agentic risk
This skill is a simple Lokuli MCP booking helper for IT-support services, with no local code or persistence, but users should confirm before sending contact details or creating a booking.
Install only if you are comfortable using Lokuli's external MCP service for IT-support search and booking. Before creating a booking, confirm the provider, time slot, and any contact details being sent, especially name, email, and phone number.
The trigger language is overly broad because it activates on essentially any IT-support service request, which can cause the skill to be invoked outside a narrowly expected booking context. In practice, this increases the chance of unintended routing to an external MCP service and unnecessary disclosure of user intent or booking-related data without clear user awareness.
The create_booking example includes personal data fields such as name, email, and phone number, but the documentation does not warn that this information will be transmitted to an external third-party service. This can lead to privacy violations, uninformed consent issues, and accidental exposure of personally identifiable information if users or integrators are not clearly informed.
No suspicious patterns detected.
