Security audit
Security checks for vulnerabilities and agentic risk
This booking skill is mostly coherent, but it can route broad waxing requests into an external booking flow that sends contact details without clearly requiring user confirmation.
Install only if you are comfortable using Lokuli's external MCP service for waxing searches and bookings. Before any booking is created, the agent should confirm the provider, service, date/time, and that your name, email, and phone may be sent to Lokuli.
The skill instructs use of an external MCP endpoint for booking and includes fields for customer name, email, and phone, but does not warn that this personal data will be transmitted to a third-party service. That omission undermines informed consent and can expose users to privacy and compliance risks if sensitive contact data is sent off-platform unexpectedly.
The trigger language is broad enough to activate on essentially any waxing-related request, without clearly constraining whether the user wants discovery, comparison, or an actual booking workflow. In a booking skill, overbroad activation can cause the agent to route users into an external transaction flow prematurely, increasing the chance of unintended data sharing or unauthorized booking actions.
No suspicious patterns detected.
