Book Guitar Lessons
v1.0.1Book guitar-lessons services through Lokuli MCP. Use when user needs to find and book guitar-lessons. Triggers on requests like "book a guitar-lessons", "find guitar-lessons near me", or any guitar-lessons service request.
⭐ 1· 1.3k·0 current·0 all-time
byLokuli@edwardrodriguez703-design
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill claims to book guitar lessons via Lokuli's MCP and the SKILL.md points at an external MCP endpoint and defines search/check/create RPC calls — this is coherent with the stated purpose. However, no authentication or API credential is declared even though an external service endpoint is specified; either the platform supplies auth via built-in tools or the SKILL.md omitted required credentials.
Instruction Scope
The runtime instructions include JSON-RPC templates that would transmit customer name, email, and phone to an external service but do not instruct the agent to prompt the user for or obtain explicit consent before sending PII. The skill also uses hard-coded example values (zipCode: "90640", dates and sample customer info) rather than instructing the agent to use the user's location and inputs, which risks accidental use of placeholder data or inappropriate data exfiltration. The MCP endpoint is external (lokuli.com) — sending PII externally without clear auth/consent is a concern.
Install Mechanism
Instruction-only skill with no install spec and no code files. This has minimal install risk because nothing is written to disk by the skill package itself.
Credentials
The skill requests no environment variables or credentials. That could be reasonable if the platform's tools handle Lokuli authentication, but it is unexpected given the external MCP endpoint. The absence of declared credentials raises the question of how the agent will authenticate — the SKILL.md does not explain whether platform-managed credentials are required or whether the endpoint is public.
Persistence & Privilege
The skill is not always-enabled and does not request elevated persistence. It is user-invocable and allowed to be invoked autonomously (platform default), which is normal and not by itself a concern.
What to consider before installing
Before installing, verify the skill's source (no homepage or repo provided) and confirm how it authenticates to https://lokuli.com/mcp/sse. Ask the publisher whether the platform supplies credentials or if you must provide an API key — absence of declared credentials is unexpected for an external booking API. Ensure the agent will: (1) ask you for your ZIP/location and contact details rather than using hard-coded examples, (2) explicitly request consent before submitting your name/email/phone to the external service, and (3) show where requests will be sent so you can confirm the domain is legitimate. If you cannot verify the publisher or the authentication model, avoid installing or using the skill for real bookings that involve your personal data.Like a lobster shell, security has layers — review code before you run it.
latestvk979nv0ktpemr4bsdn4f4g6r2980nx38
License
MIT-0
Free to use, modify, and redistribute. No attribution required.