by 安全扫描
OpenClaw
可疑
medium confidenceThe skill appears to implement the described package-tracking functionality and its script only talks to Kuaidi100, but the package metadata omits the required API credentials and the SKILL.md encourages persisting secrets in shell rc files — this metadata/instruction mismatch and secret-handling guidance are cause for caution.
评估建议
This skill’s code matches its stated purpose: it auto-detects a carrier and sends a signed HTTPS request to poll.kuaidi100.com. However, the package metadata omitted the fact that two API credentials are required — SKILL.md and scripts/track.sh do require EXPRESS_TRACKER_KEY and EXPRESS_TRACKER_CUSTOMER. Before installing or using: (1) verify the skill source and prefer running the included script locally rather than giving the agent persistent access to your secrets; (2) avoid pasting API keys ...详细分析 ▾
⚠ 用途与能力
The skill's name/description (Kuaidi100-based tracking) matches what the included script does: local carrier detection + signed POST to poll.kuaidi100.com. However, the registry metadata lists no required environment variables or primary credential while the SKILL.md and scripts/track.sh both require EXPRESS_TRACKER_KEY and EXPRESS_TRACKER_CUSTOMER. That metadata/instruction mismatch is an incoherence a user should notice.
⚠ 指令范围
SKILL.md and scripts/track.sh limit actions to local carrier-detection logic and a single HTTPS POST to poll.kuaidi100.com and JSON parsing; they do not access other system credentials or network endpoints. But the SKILL.md explicitly instructs users to persist API keys by appending exports to ~/.bashrc or ~/.zshrc, which encourages storing secrets in plaintext in shell startup files. The Agent Integration snippet references placeholders ($KEY / $CUSTOMER) not declared in registry metadata, another mismatch.
✓ 安装机制
This is an instruction-only skill with a bundled shell script; there is no install spec, no downloads, and no packages installed by the skill. It relies on standard local binaries (curl, jq, md5/openssl) which is proportionate to its purpose.
⚠ 凭证需求
The only secrets the skill needs (EXPRESS_TRACKER_KEY and EXPRESS_TRACKER_CUSTOMER) are appropriate for Kuaidi100 API access. However, the registry metadata claimed 'no required env vars' while the runtime instructions and script require two API credentials — this inconsistency reduces trust and should be corrected/clarified before use.
✓ 持久化与权限
The skill does not request permanent platform-level privileges (always:false) and does not modify other skills or system-wide agent settings. The only persistence recommended is optional user action to add exports to shell rc files (which is a user-facing suggestion, not an automated change).
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/24
- Initial release of cn-express-tracker for querying package tracking information via the Kuaidi100 API. - Supports auto-detection of carrier from tracking number or manual carrier specification. - Tracks packages from over 200 Chinese and international carriers. - Requires user-provided Kuaidi100 API credentials (API Key and Customer ID) set via environment variables. - Outputs detailed tracking timeline; provides error code explanations and manual carrier override options. - Includes Bash script usage instructions and carrier code reference.
● 无害
安装命令 点击复制
官方npx clawhub@latest install cn-express-tracker
镜像加速npx clawhub@latest install cn-express-tracker --registry https://cn.clawhub-mirror.com
技能文档
Track packages from 200+ carriers (Chinese domestic + international) via Kuaidi100 API.
Setup (必填)
Users must obtain their own Kuaidi100 API credentials:
- 注册企业版账号（个人也可注册） - Free tier: 100 queries/day 之后 verification- 获取 credentials 从 Kuaidi100 Dashboard:
- 设置 environment variables:
export EXPRESS_TRACKER_KEY="your_api_key_here"
export EXPRESS_TRACKER_CUSTOMER="your_customer_id_here"
For persistent config, add to ~/.bashrc or ~/.zshrc:
echo 'export EXPRESS_TRACKER_KEY="your_key"' >> ~/.zshrc
echo 'export EXPRESS_TRACKER_CUSTOMER="your_customer"' >> ~/.zshrc
Usage
# Auto-detect carrier and query
scripts/track.sh # Specify carrier manually
scripts/track.sh
Examples
# Auto-detect (recommended)
scripts/track.sh 770308811947591# Specify carrier explicitly
scripts/track.sh SF1234567890 shunfeng
如何 Works
- Carrier auto-detection: Local rule-based matching 由 tracking 数字 prefix/length/格式
- API 查询: Sends signed 请求 到 Kuaidi100 poll API 带有
resultv2=4对于 advanced status - 输出: Formatted timeline 带有 满 tracking history (newest 第一个)
Supported Carriers (Auto-Detection)
| Prefix/Pattern | Carrier | Code |
|---|---|---|
SF | 顺丰速运 | shunfeng |
YT | 圆通速递 | yuantong |
JT / J0 | 极兔速递 | jitu |
JD | 京东快递 | jd |
CN | 菜鸟速递 | cainiao |
DPK | 德邦快递 | debangkuaidi |
KYE | 跨越速运 | kuayue |
AN | 安能物流 | annengwuliu |
1Z | UPS | ups |
78/73/72/21/68 + digits | 中通快递 | zhongtong |
10/11/12/13/19/46 + 13 digits | 韵达快递 | yunda |
77/88/66/55/44 + 13-15 digits | 申通快递 | shentong |
E + letter + 9 digits + 2 letters | EMS | ems |
Full carrier code list: Kuaidi100 Carrier Codes
Dependencies
curl— HTTP requestsjq— JSON parsing (install:brew install jq/apt install jq)openssl或md5sum或md5— MD5 signature (在 最少 one 必填)
错误 Codes
| Code | Meaning | Action |
|---|---|---|
| 400 | Incomplete data / wrong carrier | Check carrier code |
| 408 | Phone verification failed | SF/ZTO require phone number |
| 500 | No tracking info found | Verify tracking number and carrier |
| 503 | Signature verification failed | Check API Key and Customer ID |
| 601 | API Key expired / no balance | Recharge account |
Agent Integration
When a user provides a tracking number, run:
EXPRESS_TRACKER_KEY="$KEY" EXPRESS_TRACKER_CUSTOMER="$CUSTOMER" scripts/track.sh
Parse the output and present the tracking timeline to the user. If carrier detection fails, ask the user which carrier it is.
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制