Security audit
Security checks across malware telemetry and agentic risk
This package-tracking skill does what it claims, but it should be installed only by users comfortable sharing tracking data with Kuaidi100 and optionally writing delivery reminders to Google Calendar.
Before installing, make sure you are comfortable sending tracking numbers, carrier data, callback URLs, and package status to Kuaidi100. Only add Google Calendar credentials if you want the skill to create or update delivery reminder events. Use a strong webhook token, configure a Kuaidi100 salt, prefer strict signature mode where possible, and remove tracked packages when you no longer need them.
headers={"Content-Type": "application/x-www-form-urlencoded; charset=UTF-8"},
method="POST",
)
with urllib.request.urlopen(req, timeout=20) as resp:
return json.loads(resp.read().decode())
except Exception as e:
return {"error": str(e)}headers={"Content-Type": "application/x-www-form-urlencoded; charset=UTF-8"},
method="POST",
)
with urllib.request.urlopen(req, timeout=20) as resp:
return json.loads(resp.read().decode())
except Exception as e:
return {"error": str(e)}62/62 vendors flagged this skill as clean.
Detected: suspicious.exposed_secret_literal