← 返回 Skills 市场

Book Dance Lessons

Name: Book Dance Lessons
Author: edwardrodriguez703-design

作者 Lokuli · GitHub ↗ · v1.0.1

cross-platform ⚠ suspicious

1400

总下载

当前安装

版本数

在 OpenClaw 中安装

/install book-dance-lessons

功能描述

使用说明 (SKILL.md)

uook dance lessons

Book dance-lessons services through Lokuli's MCP server.

MCP Endpoint

https://lokuli.com/mcp/sse

Transport: SSE | JSON-RPC 2.0 | POST requests

Tools

search

{
  "method": "tools/call",
  "params": {
    "name": "search",
    "arguments": {
      "query": "dance-lessons",
      "zipCode": "90640",
      "maxResults": 20
    }
  }
}

check_availability

{
  "method": "tools/call",
  "params": {
    "name": "check_availability",
    "arguments": {
      "providerId": "xxx",
      "serviceId": "yyy",
      "date": "2025-02-10"
    }
  }
}

create_booking

{
  "method": "tools/call",
  "params": {
    "name": "create_booking",
    "arguments": {
      "providerId": "xxx",
      "serviceId": "yyy",
      "timeSlot": "2025-02-10T14:00:00-08:00",
      "customerName": "John Doe",
      "customerEmail": "[email protected]",
      "customerPhone": "+13105551234"
    }
  }
}

安全使用建议

This skill appears to do what it says (search and create bookings) but the SKILL.md is incomplete and could cause your agent to send user personal data to https://lokuli.com without explaining authentication or consent. Before installing: 1) ask the publisher for details on how the MCP endpoint is authenticated and where credentials are stored; 2) confirm the legitimacy of lokuli.com and ask for a privacy/data-flow statement (what data is sent, stored, retention); 3) request that example hard-coded values be removed and replaced with explicit prompts so PII is only sent with user consent; 4) test in a sandboxed environment and monitor network calls; and 5) prefer a skill that declares required credentials and has a verified homepage/owner. Providing the skill's owner info, an explicit auth flow, or an official homepage would increase confidence.

功能分析

Type: OpenClaw Skill Name: book-dance-lessons Version: 1.0.1 The skill bundle is benign. It clearly defines its purpose as booking dance lessons through the Lokuli MCP server at `https://lokuli.com/mcp/sse`. The `SKILL.md` file outlines three tools (`search`, `check_availability`, `create_booking`) with arguments directly relevant to this stated purpose. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, obfuscation, or prompt injection attempts designed to subvert the agent's behavior for harmful ends. The minor typo in the `SKILL.md` heading ('uook' instead of 'book') is not indicative of malicious intent.

能力评估

ℹ Purpose & Capability

Name and description match the instructions (calls to a Lokuli MCP endpoint using JSON-RPC to search, check availability, and create bookings). However, the skill declares no credentials or auth method while pointing to an external booking endpoint, which is unusual for a service that performs bookings on behalf of users.

⚠ Instruction Scope

SKILL.md shows JSON-RPC tool calls that would transmit customer PII (name, email, phone) and fixed parameters (zipCode=90640, sample dates) to https://lokuli.com/mcp/sse. The document provides no guidance on authentication, consent, or what data is required vs. optional. The presence of hard-coded example values and a stray typo ('uook dance lessons') suggests sloppy or incomplete instructions.

✓ Install Mechanism

Instruction-only skill with no install spec and no code files. That minimizes disk-write risk; there is no package download or local install activity.

⚠ Credentials

The skill requests no environment variables or credentials, yet the runtime instructions call an external MCP endpoint that would normally require authentication. Absence of declared credentials is disproportionate and leaves unclear how bookings would be authorized. Also, the skill will involve sending user PII to an external domain — that should be explicitly justified and protected.

✓ Persistence & Privilege

Defaults are used (not always:true). The skill does not request persistent or elevated platform privileges in the manifest.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install book-dance-lessons
安装完成后，直接呼叫该 Skill 的名称或使用 /book-dance-lessons 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.0.1

Fixed display name

v1.0.0

Initial release

元数据

Slug book-dance-lessons

版本 1.0.1

许可证 —

累计安装 0

当前安装数 0

历史版本数 2

常见问题