ClawHub

kuaidi100-user

v1.0.2

快递100用户版智能寄件助手：寄件下单全流程（支持无Key模式/完整模式）、物流查询、订单管理。无Key模式优先使用本地缓存数据自动填充寄件人和收件人，完整模式支持服务端地址簿查询和物流跟踪。Use when: 用户要寄快递、查物流、管理快递订单、比价选快递、查运费，或提到快递100/寄件/查单/运费/快递价格相...

⭐ 0· 164·0 current·0 all-time
by快递100API@kuaidi100-api
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Pending
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description, SKILL.md, API docs, and included Python scripts all align: local caching + optional server features via KUAIDI100_USER_API_KEY. No unrelated credentials, binaries, or external services are requested; base URL is the expected p.kuaidi100.com.
✓
Instruction Scope
SKILL.md prescribes multiround dialogs, local-first behavior, and optional use of the upstream API when an API key is present. It does not instruct reading arbitrary system files or exfiltrating data. It does write/read user data under ~/.openclaw/kuaidi100-user/data/ (addresses, phones, orders) which is consistent with the skill's purpose.
✓
Install Mechanism
Instruction-only skill with two Python scripts; no installer or remote download. Dependencies are reasonable (Python 3.7+, requests) and are declared in SKILL.md. No high-risk install behavior detected.
✓
Credentials
No required environment variables declared; the optional KUAIDI100_USER_API_KEY is justified by the described '完整模式' (server features). The client handles missing keys gracefully and marks key-required calls with 401/key_required. No unrelated secrets or broad credential requests are present.
✓
Persistence & Privilege
Skill stores local user data under the user's home directory (~/.openclaw/kuaidi100-user/data/) to implement local-first behavior. always:false and no system-wide modifications are requested. Note: local data includes personal contact details and recent orders; the code also exposes clear_all_data() to delete local files.
Assessment
This skill appears to do what it claims. Before installing, consider: (1) Local data storage: it saves names, phone numbers, addresses and order metadata under ~/.openclaw/kuaidi100-user/data/ — if that concerns you, run it in an isolated environment or periodically delete data using the provided clear_all_data() function. (2) API Key: providing KUAIDI100_USER_API_KEY enables server-side address/order features; only set a key you obtained from the official 快递100 mini-program and only if you trust the upstream service. (3) Network behavior: the scripts make POST requests to the fixed host https://p.kuaidi100.com; there are no other hidden endpoints. (4) Link handling: pre-order results include weixin:// links and QR URLs; automatic opening of those would launch external apps (WeChat) if a browser/tool is invoked — SKILL.md requires textual display first and treats auto-opening as optional. If you want extra assurance, review/execute the included Python files in a sandbox before granting the skill network access.

Like a lobster shell, security has layers — review code before you run it.

latestvk97e8kcxns4x2gg9fst45fjegn83w740

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments