FUTA Express package tracking skill (VN)
v1.0.0Track FUTA Express (Phương Trang) package delivery status using their public API. Use when the user wants to track/tra cứu đơn hàng, kiện hàng from FUTA Express, FUTA Express, or Phương Trang Express. Requires a tracking code (mã vận đơn) to query.
⭐ 0· 795·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description match the SKILL.md: it calls a public FUTA Express API endpoint to fetch tracking info and formats the response. There are no unrelated environment variables, binaries, or install steps requested.
Instruction Scope
Instructions stay within tracking scope (extract tracking code, call API, parse JSON, present fields). However the skill mandates showing full response data and may display sensitive recipient PII (phone numbers, ID numbers) returned by the API. The guidance to 'always show the full response' and the explicit inclusion of receive_identity/receive_phone increases privacy exposure; consider limiting or masking by default.
Install Mechanism
Instruction-only skill with no install spec and no code files — lowest-risk install footprint. The runtime uses a web_fetch call as expected.
Credentials
No environment variables, credentials, or config paths are requested. Requested data (tracking code) is appropriate for the purpose. The only proportionality concern is data returned by the API (third-party PII) but that is a function of the API response, not extra credentials requested by the skill.
Persistence & Privilege
Skill does not request always:true or system-wide configuration changes. It is user-invocable and can be invoked autonomously (platform default), which is normal for skills.
Assessment
This skill appears to do what it says: it queries a FUTA Express public API and formats the response. Before installing or using it, be aware that the API response can include sensitive personal data (recipient phone numbers and national ID numbers). Consider these precautions: only query tracking codes you are authorized to check; prefer that the skill mask or redact ID/phone values by default (show only last 2–4 digits); require explicit user confirmation before displaying full PII; and verify the API endpoint and TLS certificate if you need to rely on it in production. Also note the skill has no listed homepage or source — if provenance is important, ask the publisher for more information before deploying widely.Like a lobster shell, security has layers — review code before you run it.
latestvk976mjpa1yzzqc6b534z0bpkr580xar9
License
MIT-0
Free to use, modify, and redistribute. No attribution required.