Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent makeup-booking integration, but it can send contact details to an external booking service and create bookings without clear in-skill confirmation guidance.
Install only if you are comfortable using Lokuli for makeup-service searches and bookings. Before creating a booking, verify provider, time, price, and cancellation terms, and confirm that you want your name, email, and phone number sent to the external service.
The skill instructs booking through an external MCP endpoint and the create_booking example includes personal data fields like name, email, and phone number, but the description does not warn that this information will be transmitted to a third party. Users may provide sensitive contact details without informed consent, creating privacy, compliance, and trust risks.
The trigger text is broad enough to activate on generic makeup-related requests, not just clear booking intents. That can cause the agent to route users into an external booking workflow prematurely, increasing the chance of unnecessary third-party data exposure or unintended transactional actions.
No suspicious patterns detected.
