kuaidi100-logistics
PassAudited by ClawScan on May 1, 2026.
Overview
This instruction-only logistics skill is coherent and read-only, but using it sends package details and any optional API key to Kuaidi100.
This skill appears safe for its stated purpose. Before installing or using it, make sure you are comfortable with Kuaidi100 receiving the shipment details needed for lookups, and only configure an API key if you want the skill to use your account quota.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A casual package-related request may trigger a Kuaidi100 API call if the agent has enough information.
The skill directs the agent to invoke it proactively for logistics-related mentions. This is aligned with the skill purpose, but users should be aware it encourages automatic external lookups.
当用户提到快递单号、物流轨迹、查快递、运费估算、预计到达时间、识别快递公司等需求时，必须使用此技能。...也要主动触发此技能。
Use the skill for explicit logistics requests, and prefer confirming before sending sensitive tracking, phone, or address details.
If configured, the API key may be used for Kuaidi100 requests and could consume the user’s quota.
The skill can use a provider API key from the environment. This is expected for Kuaidi100 API access and there is no evidence of unrelated credential use or leakage.
`KUAIDI100_API_KEY`：快递100 API Key（可选，未设置时使用免费额度）
Only set KUAIDI100_API_KEY if you intend this skill to use your Kuaidi100 account, and rotate or revoke it if no longer needed.
Package identifiers, phone numbers, addresses, and logistics history may be shared with Kuaidi100 to fulfill the request.
The skill sends tracking numbers, optional phone numbers, and address information to the external Kuaidi100 API. This is necessary for the advertised logistics functions, but it is still a sensitive data flow.
queryTrace?key=${KEY}&kuaidiNum=${快递单号}&phone=${手机号} ... --data-urlencode "recAddr=${收件地址}" ... --data-urlencode "sendAddr=${寄件地址}"Avoid sending package or contact details you do not want shared with Kuaidi100, and review any organization privacy requirements before use.