Book Landscaper

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:25 AM UTC
• Version: 1.0.1

Overview

This skill is for booking landscapers, but it can send contact details and create an external booking without clearly requiring final user confirmation.

Review before installing. Use this skill only if you are comfortable with an agent contacting Lokuli's external MCP service and potentially sending your name, email, and phone number to create a landscaping appointment. The skill should be used with an explicit final confirmation step for provider, service, time, price or fees, cancellation terms, and contact details before any booking is created.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:50
• Finding: External Booking and Personal Data Submission Without Mandatory User Confirmation## Vulnerability Details **File Location**: `SKILL.md`, lines 50–66 **Vulnerability Type**: Missing confirmation and privacy controls for an externally consequential action **Risk Level**: Medium ### Vulnerable Code ```json ### create_booking { "method": "tools/call", "params": { "name": "create_booking", "arguments": { "providerId": "xxx", "serviceId": "yyy", "timeSlot": "2025-02-10T14:00:00-08:00", "customerName": "John Doe", "customerEmail": "[e-mail]", "customerPhone": "[phone]" } } } ``` ### Technical Analysis The skill defines a `create_booking` operation that can create an external reservation and transmit personally identifiable information, including the customer's name, email address, and phone number. However, the skill contains no instruction requiring explicit user confirmation immediately before this operation is invoked. It also does not require the agent to present and verify the provider, service, appointment time, price, cancellation terms, or personal information that will be disclosed. No controls prohibit the agent from inferring or reusing contact information without the user's informed approval. Authentication requirements, authorization boundaries, failure handling, and duplicate-booking protections are also undocumented. Consequently, an agent following this skill could treat a general request to find or book a landscaper as sufficient authorization to execute the consequential booking operation. ### Attack Path 1. A user makes a broad request to find or book a landscaper. 2. The skill directs the agent to use the external Lokuli MCP service. 3. The agent searches for providers and checks availability. 4. The agent obtains, reuses, or infers the user's name, email address, and phone number. 5. Because the skill defines no mandatory confirmation boundary, the agent invokes `create_booking` without presen ...[truncated 923 chars]
• Remediation: ## Remediation Suggestions - Require explicit, affirmative user confirmation immediately before every `create_booking` call. - Present a final booking summary containing the provider, service, date and time, time zone, price, applicable fees, cancellation terms, and all personal data that will be transmitted. - Treat searching and availability checks as non-authorizing preparatory steps; they must not imply authorization to create a booking. - Prohibit inferred, fabricated, or silently reused customer contact details. Ask the user to supply or explicitly approve each required field. - Minimize disclosed data and transmit only fields required by the provider. - Document the MCP endpoint's authentication and authorization requirements, and ensure credentials are handled through an approved secret-management mechanism. - Add idempotency or duplicate-submission protection where supported. - Define safe handling for timeouts and ambiguous responses so the agent checks booking status rather than automatically retrying a consequential request. - Return the confirmed booking identifier and final details to the user after successful creation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger language is broad enough to activate on generic landscaping-related requests, which can cause the agent to route users into a booking workflow when they may only be seeking information, advice, or recommendations. In a skill that reaches an external booking service, unintended activation increases the chance of unnecessary third-party data exposure or premature transactional actions.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill supports creating bookings with personal data including name, email, and phone number, but the description does not warn that this information will be transmitted to an external MCP endpoint. Without clear disclosure and consent, users may unknowingly share sensitive contact information with a third party, creating privacy and compliance risks.

Static analysis

No suspicious patterns detected.