Post.at Tracking

Manage Austrian Post (post.at) deliveries - list packages, check delivery status, set delivery place preferences.

Security Scan

The skill's purpose (manage post.at deliveries) matches the instructions, but the package metadata is inconsistent with the runtime instructions (missing credential and install declarations), which warrants caution before installing or providing credentials.

Purpose & Capability

The SKILL.md describes an unofficial CLI that logs into post.at and manages deliveries — requiring a post.at username/password — which is coherent with the stated purpose. However the registry metadata lists no required env vars or binaries while the SKILL.md explicitly expects POST_AT_USERNAME/POST_AT_PASSWORD and mentions node in its metadata, creating an inconsistency between claimed requirements and the runtime instructions.

Instruction Scope

The instructions are narrowly scoped to using a post-at CLI to list deliveries, get details, and set delivery-place preferences. They do not instruct the agent to read unrelated system files or exfiltrate data to third-party endpoints; the only external interaction implied is with post.at (the service the skill integrates with).

Install Mechanism

This is an instruction-only skill with no install spec or code files. SKILL.md metadata references node (implying a Node CLI), but there are no install steps provided. That means the skill itself won't write code to disk, but a user must separately obtain/install the post-at CLI (from the GitHub repo). The lack of an explicit install source or verified release instructions increases risk if the user installs an untrusted binary.

Credentials

SKILL.md requires POST_AT_USERNAME and POST_AT_PASSWORD (or CLI options) to log into post.at, which is proportionate to the task. The concern is that the registry metadata and the skill manifest declare no required env vars or primary credential, so the declared surface does not match what the runtime instructions actually need — this mismatch could lead a user to unknowingly supply credentials to an unvetted CLI.

Persistence & Privilege

The skill does not request always:true and has no install/persistence behavior declared. It does mention caching short-lived session tokens (typical for a CLI), but there is no indication that the skill will install persistent system-wide components or modify other skills' config.

What to consider before installing

Before installing or running this skill, consider the following: - Verify the source: check the referenced GitHub repo (https://github.com/krausefx/post-at-cli). Inspect the code and README to confirm the CLI's install method, published package name, and whether releases/tarballs are signed. - Do not hand over credentials blindly: the SKILL.md requires POST_AT_USERNAME and POST_AT_PASSWORD. Only provide credentials to a CLI you have inspected and installed yourself from a trusted release. Prefer passing credentials interactively or via a secure vault rather than embedding them in long-lived environment variables if possible. - Installation caution: the registry entry provides no install spec. If you must install the CLI, obtain it directly from the official repo or a verified package registry (and verify checksums). Avoid running arbitrary install scripts or downloading binaries from unknown URLs. - Session storage: the CLI mentions caching short-lived session tokens. Review where and how tokens/sessions are stored on disk before using the tool on multi-user or shared machines. - If you only need occasional checks, consider running the CLI locally on your machine rather than giving an autonomous agent access to your credentials. The inconsistencies in metadata vs. SKILL.md (missing declared env vars and install instructions) suggest sloppy packaging rather than explicit malice, but they do increase risk—inspect the upstream code and install source before providing credentials or integrating the skill into autonomous workflows.

post-at CLI

Unofficial CLI for viewing and managing deliveries on post.at (Österreichische Post). Uses the same web flows as the site and requires your own account credentials.

Credentials: POST_AT_USERNAME and POST_AT_PASSWORD environment variables (or --username / --password options).

Quick Reference

Login

Cache a short-lived session (auto-expires):

post-at login
# Output: Logged in as [e-mail]

List Deliveries

Upcoming deliveries (default):

post-at deliveries
# Shows: tracking number, ETA, sender, status

All deliveries (including delivered):

post-at deliveries --all

JSON output:

post-at deliveries --json

Limit results:

post-at deliveries --limit 10

Delivery Details

Get details for a specific tracking number:

post-at delivery 1042348411302810212306
# Output: tracking, expected delivery, sender, status, picture URL

JSON output:

post-at delivery <tracking-number> --json

Delivery Place Options (Wunschplatz)

List available place options:

post-at routing place-options

Common options:

• Vor_Haustüre — Vor der Haustüre
• Vor_Wohnungstüre — Vor der Wohnungstüre
• AufOderUnter_Briefkasten — Unter / Auf dem Briefkasten
• Hinter_Zaun — Hinter dem Zaun
• In_Garage — In der Garage
• Auf_Terrasse — Auf der Terrasse
• Im_Carport — Im Carport
• In_Flexbox — In der Flexbox
• sonstige — Anderer Wunsch‑Platz

Set Delivery Place

Using preset shortcut:

post-at routing place <tracking-number> \
  --preset vor-der-wohnungstuer \
  --description "Please leave at the door"

Using key directly:

post-at routing place <tracking-number> \
  --key Vor_Wohnungstüre \
  --description "Bitte vor die Wohnungstür"

Using label:

post-at routing place <tracking-number> \
  --place "Vor der Wohnungstüre" \
  --description "Custom instructions"

Example Workflows

Check what's arriving today/tomorrow:

post-at deliveries

Get full details including package photo:

post-at delivery <tracking-number>

Set all upcoming deliveries to door:

# First list deliveries
post-at deliveries --json > /tmp/deliveries.json

# Then set place for each (requires scripting)
# Example for a specific one:
post-at routing place 1042348411302810212306 \
  --preset vor-der-wohnungstuer \
  --description "Leave at apartment door"

Notes

• Session tokens expire after a short time (auto-relogin when needed)
• Not all deliveries support Wunschplatz redirection
• Picture URLs may not be available for all packages
• Use --json output for programmatic processing