📦 Book Art Lessons — 约美术课
v1.0.1通过 Lokuli MCP 快速搜索并预约附近的美术课程，一句话搞定“我要上画画课”类需求。
1· 1.4k·0 当前·0 累计
by 下载技能包
最后更新
2026/2/28
安全扫描
OpenClaw
可疑
medium confidenceThe skill's stated purpose (finding and booking art lessons) matches its instructions, but there are several inconsistencies and missing details — notably an external MCP endpoint with no authentication guidance, hard-coded example data, and unclear data flows — that warrant caution before use.
评估建议
This skill appears to do what it claims, but before installing verify who runs the 'lokuli.com' MCP endpoint and how authentication is handled. Ask the publisher (or your platform) whether API keys or OAuth tokens are required and how the platform protects/obtains them. Be aware booking calls will send personal data (name, email, phone) to that external service — confirm privacy/consent. Also note the SKILL.md contains hard-coded example zip code and dates (likely placeholders); ensure the skill...详细分析 ▾
ℹ 用途与能力
Name/description align with the instructions (search, check_availability, create_booking). However the SKILL.md references an external MCP endpoint (https://lokuli.com/mcp/sse) while providing no explanation of how authentication, authorization, or tenancy are handled — unusual for a service that performs bookings.
ℹ 指令范围
Instructions are narrowly scoped to searching and booking via JSON-RPC 'tools/call' methods and do not ask the agent to access arbitrary local files or unrelated credentials. Concerns: the SKILL.md hard-codes sample values (zipCode 90640, specific dates, and example customer details) instead of showing how to use user-provided inputs, and it explicitly names an external endpoint which implies transmitting user PII (customerName/email/phone) but does not document consent or data handling.
✓ 安装机制
No install spec and no code files — instruction-only skill — so there is no code being downloaded or written to disk by the skill itself.
ℹ 凭证需求
The skill declares no required environment variables or credentials, yet it targets an external booking endpoint. Either the platform supplies credentials transparently or the skill is expected to work unauthenticated; the SKILL.md provides no guidance. This mismatch (external API but no declared auth) is disproportionate and worth verifying.
✓ 持久化与权限
Skill is not marked 'always:true' and does not request persistent system-wide privileges. It appears to be a standard, user-invocable instruction-only skill.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.12026/2/6
Fixed display name
● 无害
安装命令
点击复制官方npx clawhub@latest install book-art-lessons
镜像加速npx clawhub@latest install book-art-lessons --registry https://cn.longxiaskill.com