DHL Tracking

Track DHL parcels in Germany via the dhl.de API. Use when a user asks to track a DHL package, check delivery status, monitor a shipment, or wants notificatio...

Security Scan

The skill's files and runtime instructions match its stated purpose (querying a DHL tracking JSON endpoint) and it does not request extra credentials or install arbitrary code.

Purpose & Capability

Name/description match the included scripts and SKILL.md. The Python and shell scripts perform simple HTTP GETs against the DHL endpoint and format the returned JSON; nothing in the package requests unrelated services, credentials, or system resources.

Instruction Scope

SKILL.md stays on-topic (how to call the endpoint, expected JSON structure, and how to poll). It does provide guidance about varying User-Agent or adding a Referer if the endpoint becomes protected, which is guidance for working around bot protection — functionally relevant but worth noting from a policy/terms-of-service perspective. The scripts only read stdin/argv and network responses; they do not access other system files or environment variables.

Install Mechanism

No install spec; the skill is instruction-only plus two small scripts. Nothing is downloaded from external installers or written to disk by an installer step beyond the included files.

Credentials

No environment variables, credentials, or config paths are requested. The skill does not attempt to access secrets or unrelated services.

Persistence & Privilege

always is false and the skill does not request elevated persistence or modify other skills/config. Autonomous invocation is allowed (platform default) but not combined with other concerning privileges.

Assessment

This skill appears coherent and low-risk: it simply queries a DHL JSON endpoint and formats results. Things to consider before installing: (1) The skill scrapes an internal/undocumented DHL endpoint and the SKILL.md even suggests changing User-Agent/Referer if Akamai starts blocking — that may violate DHL's terms of service and could stop working if protections change. (2) Be conservative with polling (the author recommends no faster than once per minute). (3) If you need guaranteed, long-term/large-scale tracking or legal compliance, use DHL's official API (requires registration/API key). (4) The included scripts are short and readable; review them yourself if you want to confirm behavior. If you accept potential fragility and the TOS implications, this skill is internally consistent and does not request sensitive credentials.

Track DHL parcels via the dhl.de internal API endpoint using simple HTTP requests.

Important: Why this skill exists

DHL's tracking website (dhl.de/sendungsverfolgung) is a JavaScript SPA protected by Akamai Bot Manager. The SPA renders tracking data client-side after passing bot checks — headless browsers (even with stealth patches) fail due to TLS fingerprinting.

The solution: A simple curl to www.dhl.de/int-verfolgen/data/search with minimal headers returns full tracking JSON. No auth, no cookies, no JS needed.

Quick Usage

Bash (one-liner)

bash scripts/dhl_track.sh TRACKING_NUMBER

Python (formatted output)

python3 scripts/dhl_track.py TRACKING_NUMBER

Direct curl

curl -s 'https://www.dhl.de/int-verfolgen/data/search?piececode=TRACKING_NUMBER&language=de' \
  -H 'Accept: application/json' -H 'User-Agent: Mozilla/5.0'

Response Structure

sendungen[0].sendungsdetails.sendungsverlauf:
  .status              → Current status text (German)
  .fortschritt         → Progress (0-5)
  .maximalFortschritt  → Always 5
  .events[]            → Array of {datum, status, ruecksendung}

sendungen[0].sendungsdetails.zustellung:
  .zustellzeitfensterVon/Bis → Delivery window

sendungen[0].sendungsdetails.istZugestellt → boolean

Progress values

• 0-1: Label created / picked up
• 2: In transit
• 3: In recipient's region
• 4: Out for delivery (loaded onto delivery vehicle)
• 5: Delivered

Monitoring Pattern

To monitor a package and notify when close to delivery:

1. Run python3 scripts/dhl_track.py TRACKING_NUMBER periodically (cron, every 30 min)
2. Parse fortschritt from stderr JSON output
3. Notify user when fortschritt >= 4 (out for delivery)

What does NOT work (and why this skill exists)

• web_fetch on dhl.de → only gets static HTML shell, no tracking data (JS SPA)
• Headless Chrome on dhl.de → Akamai blocks internal API via TLS fingerprinting (returns 404)
• Stealth patches (fake UA, hide webdriver, fake plugins) → still detected by TLS/JA3 fingerprint
• nolp.dhl.de legacy endpoint → now also protected by Akamai (returns 500)
• DHL public API (api-eu.dhl.com) → requires API key registration
• Third-party trackers (17track, parcelsapp) → often delayed or incomplete for DE parcels

Notes

• Works for German DHL Paket numbers (typically 0034...)
• Language: language=de (German) or language=en (English)
• Be reasonable with polling (max once per minute)
• If the API starts returning 404/HTML, the Akamai protection may have expanded — try varying the User-Agent or adding a Referer: https://www.dhl.de/ header