Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward pet-grooming booking helper, but users should know it sends booking contact details to Lokuli when making an appointment.
Before installing, understand that booking through this skill may send your name, email, phone number, selected service, provider, and time slot to Lokuli. Confirm details before asking the agent to create a booking, and avoid providing more contact information than needed.
The manifest says the skill triggers on specific examples and also on "any pet-grooming service request," which is an open-ended activation condition. This lacks clear constraints or exclusion examples, increasing the chance of unintended invocation for general discussion about pet grooming rather than booking intent.
The skill includes a booking flow that transmits personal contact information to an external MCP endpoint but does not instruct the agent to warn the user, obtain consent, or minimize collected data first. In this context, the omission creates a meaningful privacy risk because users may not realize their name, email, and phone number will be sent to a third-party service.
No suspicious patterns detected.
