Jtexpress

Use J&T Express (极兔速递) for shipment tracking, shipping guidance, service-type comparison, outlet lookup, and delivery-time or fee estimation. Use when the us...

Security Scan

This skill is internally consistent with its stated purpose: a local J&T Express helper that stores history/subscriptions in a local SQLite DB and optionally encrypted files under ~/.openclaw/data/jtexpress; it does not request external credentials or obvious network exfiltration in the provided sources.

Purpose & Capability

Name/description (J&T Express helper) match the code and SKILL.md. The code implements tracking, estimates, history, subscriptions, and local persistence under ~/.openclaw/data/jtexpress which is consistent with the stated purpose.

Instruction Scope

SKILL.md clearly documents workflows and local persistence and instructs the agent to only persist when necessary. The runtime code implements the documented behavior. It does not request unrelated files, env vars, or credentials in the visible code. Note: the package contains runtime Python code (not purely prose instructions), so the agent will run bundled code rather than only following prose.

Install Mechanism

There is no install spec (no external downloads) which lowers risk. However, this skill includes code files (jtexpress.py and security.py) and a requirements.txt — the absence of an install block is not harmful but means dependency installation (cryptography, aiohttp, etc.) would be required to run the code. This is a minor inconsistency (described as 'instruction-only' but ships code).

Credentials

The skill declares no required environment variables, no credentials, and the code does not access unrelated secrets. It creates local storage and an optional local encryption key file for encrypted persisted data; these are proportionate to the stated storage/privacy features.

Persistence & Privilege

The skill persists data under its own directory (~/.openclaw/data/jtexpress) and creates an encrypted .key file only in that scope. always is false and it does not request system-wide or cross-skill configuration changes. The local persistence behavior is declared in SKILL.md and implemented in code.

Assessment

This skill appears to do what it claims: local tracking, estimates, and optional subscription/history persistence. Before installing or running it, note that: - It will create ~/.openclaw/data/jtexpress and a local SQLite DB and may create an encrypted key and files under ~/.openclaw/data/jtexpress/secure when privacy features are used. These files are stored with restrictive permissions (600) per the code. - The bundle includes Python code and a requirements.txt (cryptography, aiohttp, qrcode, pillow, etc.). Running it will require installing those dependencies; review them and install in a virtualenv or sandbox if you are cautious. - The code provided simulates tracking results and does not show external API calls in the visible portions, but aiohttp is present so additional network behavior could exist in parts truncated here — if you rely on network privacy, search the full code for outbound HTTP requests before running. - If you are uncomfortable with local persistence, use the privacy commands described (privacy info / privacy clear / privacy export) or avoid using the runtime features that persist data. Overall this package is coherent and proportional to its stated function; if you want higher assurance, run it in an isolated environment and inspect the full code for any network calls or telemetry before granting it runtime.

J&T Express (极兔速递)

Overview

Use this skill to help users with common J&T Express tasks such as tracking shipments, understanding service levels, estimating timing or fees, and preparing to send a parcel.

Local Persistence

When the local CLI/runtime code is used, this skill may create and persist local data under:

• ~/.openclaw/data/jtexpress/jtexpress.db
  • stores query history
  • stores shipment-subscription records
  • may store saved address records if those commands are implemented/used
• ~/.openclaw/data/jtexpress/secure/
  • stores encrypted local files used by the privacy/storage helper
• ~/.openclaw/data/jtexpress/secure/.key
  • stores a local encryption key file with mode 600
• ~/.openclaw/data/jtexpress/privacy_export.json
  • may be created when the user runs privacy export

Only use persistence when it is necessary for the user's requested workflow. If the user asks about privacy, disclose these paths clearly.

Privacy Controls

The local CLI supports privacy operations:

• privacy info — show local storage paths and stored-file info
• privacy clear — clear local SQLite history/subscription data and encrypted local files
• privacy export — export local storage metadata to privacy_export.json

Workflow

1. Determine the user's goal:
   • track an existing shipment
   • estimate fee or delivery time
   • compare service types
   • find a nearby outlet or pickup point
   • prepare shipment details
   • review or clear local history/subscriptions/privacy data
2. Ask for only the missing essentials, such as tracking number, route, package size, or urgency.
3. Give the most practical answer first.
4. If exact fee or timing cannot be confirmed, provide a cautious estimate and state assumptions.
5. If the task uses local runtime features that persist data, mention that local history/subscription/privacy files may be created under ~/.openclaw/data/jtexpress/.
6. Do not claim to complete real shipping actions unless live tools are available and confirmed.