ClawHub
Back to skill

Security audit

Book Photographer

Security checks across malware telemetry and agentic risk

Overview

This is a simple Lokuli photographer booking skill, with expected privacy and confirmation considerations before creating a booking.

Install only if you are comfortable using Lokuli for photographer booking. Before creating a booking, confirm the provider, date, time, cost or commitment terms, and that your name, email, phone number, and scheduling details will be sent to the external booking service.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
88% confidence
Finding
The trigger scope is broad enough to activate on essentially any photographer-related request, which can cause the skill to engage in contexts the user did not clearly intend. That increases the chance of unnecessary routing to an external booking workflow and may lead to premature data sharing or unintended service actions.

Missing User Warnings

High
Confidence
97% confidence
Finding
The skill includes a booking flow that collects and transmits personal data such as name, email, and phone number to an external MCP service, but it does not warn the user or require explicit consent before doing so. This creates a privacy and trust risk because users may not realize their contact information is being sent to a third-party booking provider.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.