kuaidi100-skill-快递100物流查询

• Analyzed: May 15, 2026, 7:18 AM
• Findings: 1
• Version: 1.1.2
• Hash: e04329d3c48314e0e4804d1fc674e3d3ac66453233d68eca00234c54aaf926f0
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill provides legitimate functionality for querying express delivery information via the Kuaidi100 API. The Node.js script (script/kuaidi100.js) uses standard built-in modules to perform HTTPS GET requests to the official API endpoint (api.kuaidi100.com). It handles API keys through a local configuration file (config.json) or environment variables as described in the documentation (SKILL.md). No evidence of data exfiltration, malicious execution, or prompt injection was found.