parcelcli
PassAudited by VirusTotal on May 12, 2026.
Overview
Type: OpenClaw Skill Name: parcelcli Version: 1.0.3 The parcelcli skill is a wrapper for a Go-based command-line tool used to track packages locally. The SKILL.md instructions are well-defined, focusing on privacy by explicitly directing the agent to keep tracking data local and avoid third-party aggregators. The installation process uses a standard Go module path (github.com/cavit99/parcelcli), and no indicators of data exfiltration, malicious execution, or prompt injection were found.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Installing the skill will rely on code from the referenced GitHub Go module, so trust in that upstream package matters.
The skill depends on installing an external Go CLI package. The version is pinned and this is central to the skill's purpose, but the runnable code is not included in the artifacts reviewed.
go | module: github.com/cavit99/parcelcli/cmd/parcelcli@v1.0.3 | creates binaries: parcelcli
Install only if you are comfortable trusting the parcelcli module and its publisher; consider reviewing the upstream repository before use.
Your tracking number, and postcode when provided, may be used on the relevant carrier's tracking site.
The skill automates a local CLI/browser workflow against carrier tracking pages. This is expected for parcel tracking and is disclosed, but it is still external web interaction using user-provided tracking details.
Use `parcelcli` for local parcel tracking. It drives public carrier tracking pages and returns a normalized JSON shape.
Provide tracking numbers and postcodes only when you want them checked with the carrier, and review results before sharing them further.
Saved watches may leave tracking details on the device until removed.
Parcel watches persist tracking numbers, labels, and possibly postcodes in local watch state for later monitoring. The behavior is user-requested and purpose-aligned, but it stores delivery-related information locally.
Use local watch state when the user asks to monitor a parcel: ... parcelcli watch add <tracking-number> --carrier evri --postcode <postcode> --label "<label>"
Use watch mode only for parcels you want monitored, and remove old watches with the documented list/remove commands when monitoring is no longer needed.