← Back to Skills Marketplace

Book Spa

Name: Book Spa
Author: edwardrodriguez703-design

by Lokuli · GitHub ↗ · v1.0.1

cross-platform ⚠ suspicious

1351

Downloads

Stars

Active Installs

Versions

Install in OpenClaw

/install book-spa

Description

Book spa services through Lokuli MCP. Use when user needs to find and book spa. Triggers on requests like "book a spa", "find spa near me", or any spa service request.

README (SKILL.md)

uook spa

Book spa services through Lokuli's MCP server.

MCP Endpoint

https://lokuli.com/mcp/sse

Transport: SSE | JSON-RPC 2.0 | POST requests

Tools

search

{
  "method": "tools/call",
  "params": {
    "name": "search",
    "arguments": {
      "query": "spa",
      "zipCode": "90640",
      "maxResults": 20
    }
  }
}

check_availability

{
  "method": "tools/call",
  "params": {
    "name": "check_availability",
    "arguments": {
      "providerId": "xxx",
      "serviceId": "yyy",
      "date": "2025-02-10"
    }
  }
}

create_booking

{
  "method": "tools/call",
  "params": {
    "name": "create_booking",
    "arguments": {
      "providerId": "xxx",
      "serviceId": "yyy",
      "timeSlot": "2025-02-10T14:00:00-08:00",
      "customerName": "John Doe",
      "customerEmail": "[email protected]",
      "customerPhone": "+13105551234"
    }
  }
}

Usage Guidance

Before installing, ask the publisher how authentication to Lokuli's MCP is handled and where API keys/sessions are stored — the skill currently declares no credentials. Require explicit user confirmation before create_booking is executed (or set disableModelInvocation: true) so the model cannot place bookings autonomously. Verify that the hosting platform's tools/call will not leak booking recipient PII and that a sandbox/testing mode exists to validate behavior without making real bookings. If you cannot get clear answers about auth and confirmation safeguards, treat this skill as high-risk and do not enable it for production use.

Capability Analysis

Type: OpenClaw Skill Name: book-spa Version: 1.0.1 The skill bundle defines tools for searching and booking spa services through a specific external endpoint, `https://lokuli.com/mcp/sse`, which aligns with its stated purpose. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or prompt injection attempts designed to subvert the agent's behavior or access sensitive data. The content of `SKILL.md` describes standard API calls for a booking service.

Capability Assessment

ℹ Purpose & Capability

Name/description and SKILL.md align: the skill describes searching, checking availability, and creating bookings via Lokuli's MCP. However, no credentials or auth mechanism are declared even though the SKILL.md references a remote MCP endpoint (https://lokuli.com/mcp/sse) that in practice is likely to require authentication.

✓ Instruction Scope

Runtime instructions are narrowly scoped to calling the Lokuli MCP via JSON-RPC 'tools/call' methods (search, check_availability, create_booking). The instructions do not request reading local files, environment variables, or unrelated system state. They do include placeholder/example fields (dates, providerId/serviceId, customer contact) that must be supplied at runtime.

✓ Install Mechanism

Instruction-only skill with no install spec and no code files — minimal installation risk. Nothing is downloaded or written to disk by the skill itself.

⚠ Credentials

The skill declares no required environment variables or primary credential, yet it calls an external MCP endpoint to create bookings. This is inconsistent: booking APIs typically require API keys or authenticated sessions. It's unclear whether authentication is expected to be provided by the hosting platform/tooling (tools/call) or was omitted. In addition, create_booking templates include user PII (name, email, phone) — the skill should justify how/where credentials and user data are supplied and protected.

⚠ Persistence & Privilege

The skill does not set disableModelInvocation and therefore can be invoked autonomously by the model. Because it can create bookings (a side-effecting operation that uses personal contact info), allowing autonomous invocation increases risk of unintended bookings or data leakage. The skill also does not set any 'always' flag (which is good), but lacking an explicit model-invocation control is a concern for safety/privacy.

How to Use

Make sure OpenClaw is installed (local or Docker)
Run the install command in chat: /install book-spa
After installation, invoke the skill by name or use /book-spa
Provide required inputs per the skill's parameter spec and get structured output

Version History

v1.0.1

Fixed name

v1.0.0

Initial release

Metadata

Slug book-spa

Version 1.0.1

License —

All-time Installs 0

Active Installs 0

Total Versions 2

Frequently Asked Questions

What is Book Spa?

Book spa services through Lokuli MCP. Use when user needs to find and book spa. Triggers on requests like "book a spa", "find spa near me", or any spa service request. It is an AI Agent Skill for Claude Code / OpenClaw, with 1351 downloads so far.

How do I install Book Spa?

Run "/install book-spa" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.

Is Book Spa free?

Yes, Book Spa is completely free (open-source). You can download, install and use it at no cost.

Which platforms does Book Spa support?

Book Spa is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).

Who created Book Spa?

It is built and maintained by Lokuli (@edwardrodriguez703-design); the current version is v1.0.1.

More Skills