Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Book Alignment
v1.0.1Book alignment services through Lokuli MCP. Use when user needs to find and book alignment. Triggers on requests like "book a alignment", "find alignment near me", or any alignment service request.
⭐ 0· 1.4k·0 current·0 all-time
byLokuli@edwardrodriguez703-design
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name and description match the runtime instructions: the SKILL.md describes searching providers, checking availability, and creating bookings against an external Lokuli MCP endpoint. There are no unrelated environment variables, binaries, or config paths requested.
Instruction Scope
Instructions are narrowly scoped to booking flows (search, check_availability, create_booking). They include examples that contain personal data fields (customerName, email, phone) which are reasonable for making bookings but mean the agent will transmit PII to the listed endpoint. The SKILL.md also exposes the external endpoint URL (https://lokuli.com/mcp/sse) — expected for this purpose, but users should know calls go off-platform.
Install Mechanism
No install spec and no code files are present (instruction-only). This is lowest-risk from an install perspective because nothing is written to disk or fetched at install time.
Credentials
The skill declares no required environment variables or credentials. The only data it needs to operate are booking-specific (location/date/customer contact) which is proportionate to its purpose.
Persistence & Privilege
always is false and the skill does not request elevated/persistent system privileges. It being invocable/autonomous is the platform default; there are no added persistence concerns in the manifest.
Assessment
This skill appears to do what it claims (find and book alignment services) and does not request system credentials or install code, but note that: 1) it will send personal contact details (name, email, phone) to https://lokuli.com — verify you trust that endpoint before creating bookings; 2) the package has no homepage or provenance information (owner ID only), so if you need higher assurance ask for more source/author details; 3) make sure the agent asks you to confirm any booking and the exact time/location before it submits PII or creates a reservation; and 4) if you want to be cautious, disable autonomous invocation for this skill or require explicit user approval for each outbound request.Like a lobster shell, security has layers — review code before you run it.
latestvk970d4wmf6q5ckp2wxhjgxjjj580nhy4
License
MIT-0
Free to use, modify, and redistribute. No attribution required.