📦 Book Language Tutor — 预约语言导师
v1.0.1通过 Lokuli MCP 搜索并预约线下语言导师，支持按地理位置、语言种类筛选，快速匹配附近教师并完成在线预订。
0· 1.4k·1 当前·1 累计
by 下载技能包
最后更新
2026/4/22
安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
This skill appears to implement booking flows but has gaps you should clarify before installing: (1) Verify how the agent authenticates to https://lokuli.com/mcp/sse — where are API keys stored and why aren't they declared? (2) Confirm that the agent will ask for explicit user consent before sending personal data (name, email, phone) and will not auto-fill/send profile data without confirmation. (3) Ask why zipCode (90640) and fixed dates appear in examples — ensure the skill will use the user's...详细分析 ▾
⚠ 用途与能力
Name/description claim to find and book language tutors and the SKILL.md shows JSON-RPC calls for search, availability, and create_booking — that matches. However, the SKILL.md references an external MCP endpoint (https://lokuli.com/mcp/sse) but the skill declares no credentials or configuration for that endpoint. Additionally, the search example hardcodes zipCode: "90640" and date examples are fixed, which conflicts with the trigger "find language-tutor near me" (should use user-provided or detected location). These mismatches are unexplained and reduce coherence.
⚠ 指令范围
Instructions are limited to three RPC-style tool calls (search, check_availability, create_booking) which is scoped to booking. But SKILL.md includes example customerName/customerEmail/customerPhone fields and gives no guidance on obtaining explicit user consent, validating or limiting what PII is sent, or how to handle errors. The document is also vague about authentication and when/how the agent should call the external MCP endpoint vs. rely on platform tools, giving the agent broad discretion that could result in unintended transmission of personal data.
✓ 安装机制
There is no install spec and no code files (instruction-only). That minimizes filesystem/installation risk.
ℹ 凭证需求
The skill declares no required env vars or credentials, yet it references an external service endpoint. Either the platform's 'tools/call' abstraction handles auth (not documented), or the skill is missing required auth details. The absence of declared API keys or tokens while instructing calls to an external MCP endpoint is a proportionality/information gap that should be clarified.
✓ 持久化与权限
always is false, no install or code, and the skill does not request persistent agent-level privileges. It does not attempt to modify other skills or system settings.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.12026/2/6
NULL
● 可疑
安装命令
点击复制官方npx clawhub@latest install book-language-tutor
镜像加速npx clawhub@latest install book-language-tutor --registry https://cn.longxiaskill.com