Spx Tracking

Query SPX Express shipment tracking by tracking number. Call this skill when the user mentions a tracking number matching the SPX format (CNMY..., SPXMY...),...

Security Scan

The skill's code, instructions, and requirements are consistent with its stated purpose (querying SPX Express tracking); it asks for no unrelated secrets or installs and performs only an HTTP query to the SPX API and local parsing.

Purpose & Capability

Name and description match the bundled script and usage. The script calls the SPX public API (spx.com.my) and parses tracking data; the declared runtime requirement (python) and requests dependency are appropriate and proportionate.

Instruction Scope

Runtime instructions limit activity to calling the SPX API, formatting results, and optionally using a provided browser cookie. The SKILL.md explicitly warns not to echo raw API responses. The script does not reference unrelated files, system state, or external endpoints beyond the SPX domain.

Install Mechanism

No install spec is provided (instruction-only), and requirements.txt only lists requests. The script may auto-create a venv and install requests per SKILL.md; this is a low-risk, expected behavior for a Python helper script.

Credentials

No environment variables or credentials are required. The only sensitive input is an optional `--cookie` argument which, if supplied, is sent to spx.com.my as an HTTP Cookie header. This is reasonable for accessing authenticated sessions but is sensitive — users should avoid supplying session cookies unless necessary.

Persistence & Privilege

The skill is not always-enabled and requests no system or agent-wide privileges. It does not modify other skills or global configuration. Autonomous invocation is allowed (platform default) and is not combined with elevated privileges here.

Assessment

This skill appears to do exactly what it claims: query the SPX public tracking API and format results. Before installing or using it: (1) Do not provide browser session cookies unless you understand the privacy implications — the script will forward any cookie you pass to spx.com.my. (2) If you want maximum privacy, run it without the --cookie flag; the public API typically supports unauthenticated reads. (3) The package auto-installs the Python requests library into a venv on first run — review or run in an isolated environment if you prefer. (4) The SKILL.md warns not to output raw API responses; if you rely on this skill, you may want to inspect or run the script locally to confirm it only returns the structured fields you expect.

SPX Express Tracking

Query SPX Express (spx.com.my) shipment tracking and return structured results.

Invocation

python skills/spx-tracking/scripts/spx_tracking.py <tracking_number> [--format json|text|summary] [--cookie "..."] [--timeout 15]

Arguments

Argument	Description
tracking_number	SPX tracking number (format: CNMY..., SPXMY...)
--format	json (default) — structured data; text — human-readable; summary — one-line status
--cookie	Browser cookie for authenticated requests (optional, sensitive — contains session data, never log or echo to user)
--timeout	Request timeout in seconds (default: 15)

Dependencies

The run script auto-creates a venv and installs requests on first use. Manual install:

pip install -r requirements.txt

Output Format Detail

• --format json (default) — Full JSON. retcode is at the top level. Agent checks retcode == 0 for success; non-zero means API error.
• --format text — Human-readable sections: status block, timeline, delay analysis, geo route.
• --format summary — Single-line: [<tracking_number>] status: <status> | last update: <time> | est. delivery: <min> ~ <max>.

Response Schema

Field	Contents
retcode	0 = success; non-zero = API error (check response.message)
response	API-level status message and detail
shipment	Core info: tracking_number, status, receiver_name, edd_min, edd_max, first_event_time, last_event_time
timeline.grouped_events	Chronological events, deduplicated (use for display)
timeline.raw_events	All raw events (use for debugging)
geo_route	Events with GPS: current_lng, current_lat, current_full_address
stay_analysis	Time between consecutive events (duration_seconds)
bottleneck	The longest stay segment — where the package stalled

Intent → Action Mapping

Observed user intent	Recommended format
User provides a SPX tracking number (CNMY..., SPXMY...)	--format summary → one-liner reply
"快递到哪了" / "where is my package" / "parcel status"	--format json → status + last_event_time + last location
"预计什么时候到" / "when will it arrive" / "ETA"	--format json → edd_min ~ edd_max
"快递卡住了" / "is it stuck" / "delay"	--format json → bottleneck section
"完整物流" / "full details" / "tracking history"	--format text → full human-readable report

Usage Constraints

• SPX Express (spx.com.my) and CAINIAO (菜鸟 / 菜鸟集运): This skill covers both SPX Direct and CAINIAO Smart Logistics tracking numbers used in the Malaysia region. CAINIAO's last-mile carrier in Malaysia is SPX Express, so CAINIAO numbers are queryable via this same API.
• Tracking number format: SPX numbers start with CNMY or SPXMY. CAINIAO numbers may have different prefixes but can be searched directly if the user identifies them as CAINIAO/菜鸟/菜鸟集运.
• Do NOT use for: J&T, Pos Laju, DHL, FedEx, UPS, Ninja Van, or any other courier.
• Privacy: Never output the raw API response body. Only use the structured fields described above.