17TRACK

Track parcels and shipments via the 17TRACK API. Manage a local SQLite database of tracked packages with automatic status polling, webhook ingestion, and dai...

Security Scan

The skill's code, instructions, and required secrets align with a parcel-tracking tool that talks to 17TRACK and stores data locally, with only minor metadata inconsistencies to verify before install.

Purpose & Capability

Name/description (17TRACK parcel tracking) match the included scripts and behavior: the code calls the 17TRACK API endpoints, stores data in a local SQLite DB, supports polling, webhooks, and daily reports. Required artifacts (TRACK17_TOKEN, optional webhook secret, data dir overrides) are appropriate for this purpose.

Instruction Scope

SKILL.md instructs the agent to initialize DB, add packages, sync, run webhooks or ingest payloads, and run the daily report. All runtime actions described (reading/writing local DB, calling 17TRACK endpoints, running a local webhook server) are consistent with the stated purpose and map to explicit script commands. The guidance to not echo secrets is present. The skill asks the agent to activate whenever a user mentions package tracking — broad but consistent with the skill's goal.

Install Mechanism

No install spec is present (instruction-only installation with included scripts). This is low-risk: nothing is downloaded at install time and bundled scripts are plain Python using only the stdlib.

Credentials

The runtime requires a single API token (TRACK17_TOKEN) and optionally TRACK17_WEBHOOK_SECRET, TRACK17_DATA_DIR, TRACK17_WORKSPACE_DIR, and TRACK17_LANG — all proportionate. Note: the registry metadata shown at the top of the report earlier said "Required env vars: none," while SKILL.md and the scripts clearly require TRACK17_TOKEN; this metadata mismatch should be resolved before trusting automated installation/configuration.

Persistence & Privilege

Skill does not request always: true and does not modify other skills or system-wide settings. It stores data under a workspace/packages/track17 directory (configurable). The webhook server binds to user-specified addresses; by default the docs suggest 127.0.0.1 which keeps it local.

Assessment

This skill appears coherent for 17TRACK parcel tracking, but verify a few things before installing: (1) Confirm the official source — _meta.json points to a GitHub repo; the registry summary earlier said 'source unknown' — prefer installing from that GitHub repo or reviewing it yourself. (2) Provide TRACK17_TOKEN only (do not paste it into public files); the skill expects the token in ~/.clawdbot/clawdbot.json or as an env var. (3) If you enable webhooks, set TRACK17_WEBHOOK_SECRET and bind the server to 127.0.0.1 or a controlled IP; review firewall rules if exposing to the public internet. (4) Inspect the bundled scripts (they appear to use only stdlib and call only 17TRACK endpoints) and ensure the resolved data directory is acceptable — you can set TRACK17_DATA_DIR to an explicit path to avoid unexpected workspace discovery. (5) Resolve the registry metadata mismatch about required env vars before automated install; if uncertain, run the scripts locally in an isolated environment first.

17TRACK Parcel Tracking

Track parcels using the 17TRACK Tracking API v2.2. Stores everything in a local SQLite database — no external dependencies beyond Python 3 stdlib.

Requirements

• TRACK17_TOKEN — your 17TRACK API token (sent as the 17token header). Configure it in ~/.clawdbot/clawdbot.json:

{
  "skills": {
    "entries": {
      "17track": {
        "enabled": true,
        "apiKey": "YOUR_17TRACK_TOKEN"
      }
    }
  }
}

Or export TRACK17_TOKEN in your shell.

Data Storage

Data lives under <workspace>/packages/track17/ where <workspace> is auto-detected from the skill installation path (parent of the skills/ directory). Override with TRACK17_DATA_DIR or TRACK17_WORKSPACE_DIR.

Quick Start

python3 {baseDir}/scripts/track17.py init                                     # Initialize DB
python3 {baseDir}/scripts/track17.py add "RR123456789CN" --label "Headphones"  # Add a package
python3 {baseDir}/scripts/track17.py sync                                      # Poll for updates
python3 {baseDir}/scripts/track17.py list                                      # List all packages
python3 {baseDir}/scripts/track17.py status 1                                  # Details for package #1

If carrier auto-detection fails, specify one: --carrier 3011

Common Commands

Action	Command
Add package	add "TRACKING_NUM" --label "Description" [--carrier CODE]
List all	list
Sync updates	sync
Package details	status <id-or-tracking-number>
Stop tracking	stop <id>
Resume tracking	retrack <id>
Remove from DB	remove <id>
API quota	quota

Webhooks (optional)

17TRACK can push updates instead of polling. Prefer polling (sync) for simplicity — webhooks are only needed if you want real-time updates.

# Run a webhook HTTP server
python3 {baseDir}/scripts/track17.py webhook-server --bind 127.0.0.1 --port 8789

# Or ingest a payload directly
cat payload.json | python3 {baseDir}/scripts/track17.py ingest-webhook

# Process saved payloads from inbox
python3 {baseDir}/scripts/track17.py process-inbox

Set TRACK17_WEBHOOK_SECRET to verify webhook signatures.

Daily Reports with Auto-Cleanup

The scripts/track17-daily-report.py script syncs all packages, auto-removes delivered ones, and prints a formatted status report to stdout. It uses the same path resolution and env vars as the main script — no hardcoded paths or external config files.

TRACK17_TOKEN=your-token python3 {baseDir}/scripts/track17-daily-report.py

Agent Guidance

• Prefer sync (polling) over webhooks unless the user explicitly wants push updates — it's simpler and doesn't require a server.
• After adding a package, run status to confirm the carrier was detected and tracking data is available.
• When summarizing, prioritize actionable items: delivered/out-for-delivery, exceptions, customs holds, carrier handoffs.
• Delivered packages are automatically cleaned up by the daily report. For ad-hoc checks, use sync then list.
• Never echo TRACK17_TOKEN or TRACK17_WEBHOOK_SECRET — these are secrets.