Spx Tracking
v1.0.1Query SPX Express shipment tracking by tracking number. Call this skill when the user mentions a tracking number matching the SPX format (CNMY..., SPXMY...),...
⭐ 0· 112·0 current·0 all-time
byWiz@wiziscool
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name and description match the bundled script and usage. The script calls the SPX public API (spx.com.my) and parses tracking data; the declared runtime requirement (python) and requests dependency are appropriate and proportionate.
Instruction Scope
Runtime instructions limit activity to calling the SPX API, formatting results, and optionally using a provided browser cookie. The SKILL.md explicitly warns not to echo raw API responses. The script does not reference unrelated files, system state, or external endpoints beyond the SPX domain.
Install Mechanism
No install spec is provided (instruction-only), and requirements.txt only lists requests. The script may auto-create a venv and install requests per SKILL.md; this is a low-risk, expected behavior for a Python helper script.
Credentials
No environment variables or credentials are required. The only sensitive input is an optional `--cookie` argument which, if supplied, is sent to spx.com.my as an HTTP Cookie header. This is reasonable for accessing authenticated sessions but is sensitive — users should avoid supplying session cookies unless necessary.
Persistence & Privilege
The skill is not always-enabled and requests no system or agent-wide privileges. It does not modify other skills or global configuration. Autonomous invocation is allowed (platform default) and is not combined with elevated privileges here.
Assessment
This skill appears to do exactly what it claims: query the SPX public tracking API and format results. Before installing or using it: (1) Do not provide browser session cookies unless you understand the privacy implications — the script will forward any cookie you pass to spx.com.my. (2) If you want maximum privacy, run it without the --cookie flag; the public API typically supports unauthenticated reads. (3) The package auto-installs the Python requests library into a venv on first run — review or run in an isolated environment if you prefer. (4) The SKILL.md warns not to output raw API responses; if you rely on this skill, you may want to inspect or run the script locally to confirm it only returns the structured fields you expect.Like a lobster shell, security has layers — review code before you run it.
deliveryvk97f5qhdb4rmhzvcq19a67zg8183b8r5latestvk97c8hnca7jgpnrhy55ay4aqph83bmjzlogisticsvk97f5qhdb4rmhzvcq19a67zg8183b8r5spexvk97f5qhdb4rmhzvcq19a67zg8183b8r5spxvk97f5qhdb4rmhzvcq19a67zg8183b8r5trackingvk97f5qhdb4rmhzvcq19a67zg8183b8r5
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
Any binpython3, python