Security audit

Book Wedding

Security checks across malware telemetry and agentic risk

Overview

This looks like a legitimate wedding-booking skill, but it needs review because it can create real bookings and send contact details to Lokuli without explicit confirmation instructions.

Install only if you are comfortable using Lokuli for wedding-service search and booking. Before any booking, require the agent to confirm the provider, service, date and time, price or deposit, cancellation terms, and the exact contact details that will be sent.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger scope is overly broad because it activates on essentially any wedding-related request, which can cause the skill to engage in contexts where the user only wants information rather than booking. In a booking skill, this increases the chance of unnecessary routing into a flow that searches vendors or collects personal data without sufficiently clear user intent.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill includes a booking flow that collects and transmits personal contact data such as name, email, and phone number to an external MCP endpoint, but it does not warn the user or describe consent expectations. This creates privacy and compliance risk because sensitive personal data may be sent to a third party without clear notice, purpose limitation, or explicit confirmation.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.