Lokuli Service Booking
v1.0.0Book real-world services through Lokuli MCP. Use when user needs to find, check availability, or book local services like plumbers, electricians, cleaners, mechanics, barbers, personal trainers, etc. Triggers on requests like "book me a haircut", "find a plumber near me", "I need a smog check", "schedule a massage", or any local service request. 75+ service categories available.
⭐ 0· 1.3k·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description align with the SKILL.md: it documents searching, availability checks, and booking flows for local services. However, the instructions reference an external MCP endpoint and JWT-signed cart mandates without documenting any authentication/credentials or who signs JWTs, which is an important operational detail missing from the skill.
Instruction Scope
Instructions stay within the booking domain (search, fetch, check_availability, create_booking). They explicitly require collecting user PII (name, email, phone) and will send that to lokuli.com and return Stripe checkout links. This is expected for booking, but the SKILL.md gives no guidance on user consent, privacy, or how payment is secured—so there's a clear privacy/safety consideration.
Install Mechanism
Instruction-only skill with no install spec and no code files: nothing will be written to disk during install. This is the lowest-risk install model.
Credentials
The skill requests no environment variables or credentials, yet describes actions that typically require auth (calling an MCP, creating JWT-signed mandates, and interacting with Stripe checkout). The absence of any declared credential requirements or explanation of who performs JWT signing/authentication is an incoherence: either the platform must supply credentials implicitly (not documented) or the spec is incomplete.
Persistence & Privilege
always:false and normal agent invocation; the skill does not request persistent or elevated privileges and does not modify other skills' configs.
What to consider before installing
This skill appears to do what it says (search and book local services), but before installing or using it you should verify a few things: (1) who authenticates requests to https://lokuli.com/mcp/sse and where any API keys / JWT signing keys live—the SKILL.md does not declare required credentials; (2) the privacy and consent model—the skill will collect and transmit personal info (name, email, phone) and provide Stripe payment links, so confirm lokuli.com's privacy and payment handling; (3) how JWT-signed 'mandates' are generated and who holds signing keys; (4) confirm the MCP endpoint is legitimate (check the domain, TLS certificate, and a published developer / privacy page). If the publisher can provide documentation that explains authentication, JWT signing, and data handling, your trust in this skill would increase; without that, treat it cautiously and avoid sending sensitive personal or payment info through it.Like a lobster shell, security has layers — review code before you run it.
latestvk97cjvkbp3ewee86efnkh2shjh80jq2w
License
MIT-0
Free to use, modify, and redistribute. No attribution required.