← 返回 Skills 市场

Book Pool Service

Name: Book Pool Service
Author: edwardrodriguez703-design

作者 Lokuli · GitHub ↗ · v1.0.1

cross-platform ⚠ suspicious

1374

总下载

当前安装

版本数

在 OpenClaw 中安装

/install book-pool-service

功能描述

使用说明 (SKILL.md)

uook pool service

Book pool-service services through Lokuli's MCP server.

MCP Endpoint

https://lokuli.com/mcp/sse

Transport: SSE | JSON-RPC 2.0 | POST requests

Tools

search

{
  "method": "tools/call",
  "params": {
    "name": "search",
    "arguments": {
      "query": "pool-service",
      "zipCode": "90640",
      "maxResults": 20
    }
  }
}

check_availability

{
  "method": "tools/call",
  "params": {
    "name": "check_availability",
    "arguments": {
      "providerId": "xxx",
      "serviceId": "yyy",
      "date": "2025-02-10"
    }
  }
}

create_booking

{
  "method": "tools/call",
  "params": {
    "name": "create_booking",
    "arguments": {
      "providerId": "xxx",
      "serviceId": "yyy",
      "timeSlot": "2025-02-10T14:00:00-08:00",
      "customerName": "John Doe",
      "customerEmail": "[email protected]",
      "customerPhone": "+13105551234"
    }
  }
}

安全使用建议

This skill is instruction-only and appears to do what it says (search, check availability, create bookings via Lokuli's MCP), but you should: 1) confirm how calls to https://lokuli.com/mcp/sse are authenticated — does the platform provide credentials or is the endpoint public? 2) require the skill to always ask for and receive explicit confirmation from the user (name, email, phone, date/time, provider) before invoking create_booking to avoid accidental bookings or data leaks, and 3) verify Lokuli's privacy policy and what customer data is transmitted. If you need higher assurance, ask the skill author to add explicit auth requirements and a mandatory confirmation step or test the skill in a safe sandbox account first.

功能分析

Type: OpenClaw Skill Name: book-pool-service Version: 1.0.1 The skill bundle defines a service for booking pool services through an external endpoint `https://lokuli.com/mcp/sse`. The `SKILL.md` file outlines three tools (`search`, `check_availability`, `create_booking`) that align with this purpose, including sending customer PII (name, email, phone) as part of the booking process. There is no evidence of prompt injection attempts, data exfiltration beyond the stated purpose, malicious execution, persistence mechanisms, or obfuscation. The behavior is clearly aligned with the stated purpose, and the network access to `lokuli.com` is plausibly needed for the skill's functionality.

能力评估

ℹ Purpose & Capability

Name/description (book pool service via Lokuli MCP) align with the SKILL.md which shows search, check_availability, and create_booking RPC calls to Lokuli's MCP. However, the skill declares no credentials or auth requirements while referencing an external MCP endpoint (https://lokuli.com/mcp/sse), which is unusual for a service that performs bookings and may require authentication.

⚠ Instruction Scope

SKILL.md provides JSON-RPC 'tools/call' payloads for search, check_availability, and create_booking but is underspecified about workflow and safeguards: it uses hardcoded example arguments (zipCode, dates, customer data), doesn't instruct the agent to always ask the user to confirm booking details before calling create_booking, and does not address what user data is sent to Lokuli. That gives the agent broad discretion which could lead to unintended bookings or leaking personal data.

✓ Install Mechanism

Instruction-only skill with no install spec and no code files — lowest install risk. Nothing is written to disk by the skill itself.

ℹ Credentials

The skill requires no environment variables or credentials in metadata, which is plausible if RPC calls are routed through the platform's tools. However, the absence of declared auth for an external booking endpoint is noteworthy and should be clarified (does the platform handle authentication, or is the MCP open?).

✓ Persistence & Privilege

always is false and there are no config-path or persistence requests. The skill can be invoked autonomously (platform default), which is acceptable but combined with the instruction vagueness above could enable autonomous bookings — users should verify confirmation behavior.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install book-pool-service
安装完成后，直接呼叫该 Skill 的名称或使用 /book-pool-service 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.0.1

Fixed display name

v1.0.0

Initial release

元数据

Slug book-pool-service

版本 1.0.1

许可证 —

累计安装 0

当前安装数 0

历史版本数 2

常见问题