Security audit
Security checks for vulnerabilities and agentic risk
This skill is a simple tattoo-booking connector to Lokuli; it uses an external service and contact details in an expected way, but users should confirm before sharing personal information or booking.
Install only if you are comfortable using Lokuli as the booking service. Before any booking is created, confirm the provider, time, and that your name, email, and phone number will be sent to Lokuli.
The trigger description is broad enough to activate on generic tattoo-related requests, which can cause the skill to run when the user did not explicitly intend to engage a third-party booking workflow. In this context, unintended invocation is risky because the skill is connected to an external MCP endpoint that can search providers and progress toward booking actions.
The skill includes a booking flow that transmits personal data such as customer name, email, and phone number to a third-party service, but it does not warn the user or obtain clear consent before collection and transmission. This creates a privacy and data-handling risk because sensitive contact information may be shared externally without informed user awareness.
No suspicious patterns detected.
