Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward windshield-service booking helper, but users should know it sends booking details and contact information to Lokuli's external service.
Install only if you are comfortable using Lokuli's external MCP service for windshield searches and bookings. Before creating a booking, confirm the provider, service, time slot, and that the user's name, email, and phone number may be sent to Lokuli.
The skill collects and transmits sensitive personal data including customer name, email, phone number, and booking details to an external booking service, but the description provides no warning or consent guidance to the user. This creates a meaningful privacy and trust risk because users may not realize their personal information will leave the system and be sent to Lokuli during booking.
The manifest description uses broad trigger language such as 'any windshield service request,' which can cause the skill to activate for loosely related requests without clear user intent to use this external booking flow. In a booking skill that connects to a third-party MCP endpoint and can handle personal data, overbroad invocation increases the chance of unintended tool use and accidental transmission of user context to an external service.
No suspicious patterns detected.
