必捷快递查询 Bijie Express

What to consider before installing: - Endpoint mismatch & encryption: SKILL.md lists an HTTPS endpoint (www.bijieserv.com) but the shipped script posts to http://skill.bijieserv.com. HTTP transmits data unencrypted and a different hostname may route requests to an unexpected server. Ask the author to confirm the correct, canonical API host and that HTTPS is used everywhere. - Privacy claims vs behavior: The README/skill promises automatic desensitization, but the code only masks phone numbers when formatting results for display — it still may send the raw phone (or other fields) to the remote API. If you plan to submit real phone numbers or sensitive addresses, be cautious. - In-memory rate limiting: The script's 'query_history' is ephemeral per process. If you rely on the skill's claimed 30-minute single-number protection to avoid carrier lockouts, verify whether that state is actually persisted across agent runs. - Verify provenance: There's no homepage or known publisher. If you need to trust this skill, request the full, untruncated source, confirm the correct API domain, and ideally test with dummy/non-sensitive tracking numbers first. - Mitigations: Prefer the skill only if the API endpoint is confirmed to be official and available over HTTPS. If you must use it before confirmation, avoid providing real phone numbers or other PII; use partial/masked values instead. If the author cannot justify the http:// skill.bijieserv.com host, treat the mismatch as a red flag and avoid sending sensitive data.