Security audit

Book Pet Grooming

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward Lokuli pet-grooming booking skill; it shares booking contact details externally, which is expected for its purpose but worth confirming before use.

Install only if you are comfortable using Lokuli for pet-grooming search and booking. Before creating a booking, confirm the provider, time slot, and contact details, and assume your name, email, and phone number will be sent to Lokuli for the reservation.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger language is broad enough to activate on generic pet-grooming requests without clearly constraining when the skill should be used or whether the user has consented to use an external booking service. This can cause unintended invocation of the skill and premature routing of user requests into a third-party workflow that may collect or transmit personal data.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The skill includes a booking flow that transmits customer name, email, and phone number to an external MCP endpoint, but the description does not warn the user that their personal contact information will be shared with a third party. In a booking context this omission is dangerous because users may provide sensitive personal data without informed consent, creating privacy, compliance, and trust risks.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.