Shippo

Shippo — shipping labels, rates comparison, package tracking, address validation, and returns.

This skill appears to do what it claims (calls the Shippo API) and only needs SHIPPO_API_TOKEN, but there are two issues you should consider before installing: 1) The bundled script quietly tries to load credentials from WORKSPACE or ~/.openclaw/workspace/.env if SHIPPO_API_TOKEN isn't set. That file-read behavior is not documented — check that your workspace .env does not contain unrelated secrets you don't want accessed. 2) The Python CLI contains several implementation bugs (mismatched argument names like dest="from_addr" vs getattr(args, 'from'), broken path placeholder replacements) that can cause commands to crash or call invalid endpoints. These are quality defects, not evidence of exfiltration, but they mean you should review and test the code before using it in production. Recommended actions: review the scripts/shippo.py source yourself, confirm the token usage is only for api.goshippo.com, fix the argument and path bugs (or ask the author for a corrected release), and avoid running it in an environment where ~/.openclaw/workspace/.env contains any unrelated secrets. If you need higher assurance, request the skill's source repository or a signed release from the author (agxntsix) and test in a sandbox first.

Type: OpenClaw Skill Name: shippo Version: 1.0.0 The skill is a standard CLI wrapper for the Shippo API, used for managing shipping labels and tracking. It uses the Python standard library to make authenticated requests to 'api.goshippo.com' and includes typical logic for retrieving API tokens from environment variables or a local .env file. While there are minor coding bugs in 'scripts/shippo.py' (such as incorrect attribute names in 'cmd_create_shipment' and a mismatch in string replacement for tracking numbers), there is no evidence of malicious intent, data exfiltration, or unauthorized execution.