Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed local-service booking connector that handles personal contact details and payment links, but it requires user confirmation before booking and shows no hidden code or persistence.
Before installing, understand that booking through this skill can send your ZIP code, selected service, appointment details, name, email, and phone number to Lokuli and may send you into a Stripe checkout flow. Only provide those details when you intend to make a booking and after confirming the provider, price, and time slot.
The trigger description is broad enough to activate on generic local-service requests, which can route users into a third-party booking flow even when they only wanted information or recommendations. In this skill context, that increases the chance of unnecessary disclosure of location and contact data and can create confused-deputy behavior around real-world purchases.
The skill instructs collection and transmission of name, email, phone number, booking details, and payment flow data to Lokuli and Stripe, but it does not clearly warn users that their personal data will be sent to third parties. In a service-booking skill, this is especially sensitive because it combines identity, contact, location, appointment, and payment-related information, creating privacy and consent risks.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
## Rules
- **Never book without confirmation** — Always get explicit approval
- **Show pricing upfront** — Use get_pricing_estimates if needed
- **Collect required info** — Name, email, phone before booking
- **Default to user's ZIP** — If known from context
No suspicious patterns detected.