技能详情（站内镜像，无评论）
许可证：MIT-0
MIT-0 ·免费使用、修改和重新分发。无需归因。
版本：v1.0.0
统计：⭐ 0 · 12 · 0当前安装次数· 0历史安装次数
⭐ 0
安装量（当前） 0
🛡 VirusTotal ：良性 · OpenClaw ：可疑
Package：cjboy007/ssa-logistics-tracker
安全扫描（ClawHub）
- VirusTotal ：良性
- OpenClaw ：可疑
OpenClaw 评估
The skill's code and runtime instructions broadly match a logistics/17Track integration, but there are several inconsistencies and cross-skill file/execution assumptions (and undeclared credential requirements) that you should review before installing.
目的
The skill claims to integrate with 17Track and to send emails/alerts — and the code implements that. However the registry metadata lists no required environment variables or config paths even though config/logistics-config.json references TRACK17_API_KEY and TRACKINGMORE_API_KEY and the SKILL.md tells you to configure SMTP creds for another skill. The code also expects other skills (order-tracker, imap-smtp-email) to exist and reads their file…
说明范围
SKILL.md and source instruct the agent to read other skills' files (e.g., ../../order-tracker/data/orders.json) and to rely on an external SMTP script (../../imap-smtp-email/scripts/smtp.js). The instructions also include absolute example paths (/Users/wilson/...), and the code uses child_process.execFileSync (present at top of modules) which implies executing cross-skill scripts. Reading/executing files outside the skill boundary is scope-exp…
安装机制
No install spec is provided (instruction-only install), but the package includes code and a package.json with at least one dependency (node-cron). That means you will likely need to run npm install / ensure Node ≥18, but the registry didn't provide an install step. This is not inherently malicious but is an operational omission you should be aware of.
证书
The skill configuration references API keys (TRACK17_API_KEY, TRACKINGMORE_API_KEY) and relies on SMTP credentials from the imap-smtp-email skill, yet the skill's declared required env vars list is empty. Requesting or using other skills' .env or SMTP credentials (via executing their smtp.js) expands credential access and should be declared and justified.
持久
The skill does persistent writes under its own data/ directory (shipments.json, alert-history, scheduler logs) using atomic write/rename — that's expected. always:false and no code modifies other skills' configuration. However it does read and execute scripts from sibling skills (order-tracker, imap-smtp-email), which increases its operational reach even though it doesn't request system-wide privileges.
scripts/anomaly-detector.js:610
检测到Shell命令执行（ child_process ）。
scripts/customer-notify.js:536
检测到Shell命令执行（ child_process ）。
安装（复制给龙虾 AI）
将下方整段复制到龙虾中文库对话中，由龙虾按 SKILL.md 完成安装。
请把本段交给龙虾中文库（龙虾 AI）执行：为本机安装 OpenClaw 技能「Logistics Tracker」。简介：物流跟踪技能，对接 17Track 批量 API，自动跟踪运单状态，向客户发送邮件通知，并在异常时告警。。
请 fetch 以下地址读取 SKILL.md 并按文档完成安装：https://raw.githubusercontent.com/openclaw/skills/refs/heads/main/skills/cjboy007/ssa-logistics-tracker/SKILL.md
（来源：yingzhi8.cn 技能库）SKILL.md
暂无本地缓存内容，可在后台执行详情同步。