← Back to Skills Marketplace
349
Downloads
0
Stars
0
Active Installs
3
Versions
Install in OpenClaw
/install sf-express
Description
Use SF Express (顺丰速运) for shipment tracking, shipping guidance, service-type comparison, outlet lookup, and delivery-time or fee estimation. Use when the use...
Usage Guidance
This skill appears to do what it claims: local tracking, estimates and local persistence for history/subscriptions/addresses. Before installing: (1) Review the code (already included) if you plan to store sensitive addresses or phone numbers. (2) Note the skill creates ~/.openclaw/data/sf-express/ and a secure/ directory with a .key file (mode 600) — verify you are comfortable with local storage. (3) The encryption implementation contains a likely bug in key derivation/usage which may undermine encryption or cause the skill to fail; ask the author to fix key handling (Fernet expects a urlsafe_b64encoded 32-byte key). (4) Install dependencies in an isolated Python virtualenv and test in a sandbox before giving it real PII. (5) If you need stronger guarantees, request that the maintainer document the encryption design or remove local storage of sensitive fields. If you want, I can point to the exact lines/changes to fix the key handling and harden storage behavior.
Capability Analysis
Type: OpenClaw Skill
Name: sf-express
Version: 1.0.2
The sf-express skill bundle is a legitimate tool for tracking shipments and estimating delivery fees. It includes a dedicated security module (security.py) for encrypted local storage of history and subscriptions using the cryptography library, and it provides clear privacy controls for users to inspect or clear their data. The main logic in sfexpress.py uses standard libraries and follows the stated purpose without any signs of data exfiltration, malicious execution, or prompt injection.
Capability Assessment
Purpose & Capability
Name/description match the included code: tracking, estimates, history, subscriptions, address storage and privacy controls. No unrelated environment variables, binaries, or external cloud credentials are requested.
Instruction Scope
SKILL.md describes only SF Express workflows and explicitly documents local persistence and privacy commands. The runtime files operate on ~/.openclaw/data/sf-express and do not reference other system-wide config or unrelated paths in the shown code.
Install Mechanism
This is an instruction/code bundle with no install spec; dependencies are listed in requirements.txt (aiohttp, cryptography, etc.). No external download URLs or archive extraction are present. Installing the Python dependencies via pip is the expected mechanism.
Credentials
The skill requests no env vars or external tokens (proportionate). It does persist user data (query history, subscriptions, addresses) on disk and stores a local key file at ~/.openclaw/data/sf-express/secure/.key (mode 600). Storing address/phone data is sensitive — the persistence is reasonable for the stated functionality but users should be aware. Also, the local encryption implementation has a suspicious/incorrect key handling pattern (PBKDF2 used with random inputs and base64 encode/decode steps) that likely breaks or weakens encryption; this is an implementation bug rather than an indication of malicious intent, but it affects the privacy guarantees.
Persistence & Privilege
The skill persists data under the user's home directory and provides privacy commands to inspect/clear/export that data. always:false (no forced global presence). Persisting subscriptions/history/addresses is appropriate for the feature set, but because the skill stores potentially sensitive PII and a local key file, you should review or audit the storage and encryption behavior before storing secrets.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install sf-express - After installation, invoke the skill by name or use
/sf-express - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.2
English-first documentation update
v1.0.1
Document local persistence paths and privacy controls; reduce eager secure-storage creation; make privacy clear remove local SQLite and encrypted files.
v1.0.0
Initial release of the sf-express skill:
- Enables shipment tracking, shipping guidance, service-type comparison, outlet lookup, and delivery/fee estimation for SF Express (顺丰速运).
- Designed to help users with tracking numbers, fee/time estimates, finding outlets, and shipment preparation.
- Prompts only for essential information, gives practical answers, and clarifies assumptions when necessary.
- Does not claim to perform real shipping actions unless confirmed as supported.
Metadata
Frequently Asked Questions
What is sf-express?
Use SF Express (顺丰速运) for shipment tracking, shipping guidance, service-type comparison, outlet lookup, and delivery-time or fee estimation. Use when the use... It is an AI Agent Skill for Claude Code / OpenClaw, with 349 downloads so far.
How do I install sf-express?
Run "/install sf-express" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is sf-express free?
Yes, sf-express is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does sf-express support?
sf-express is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created sf-express?
It is built and maintained by haidong (@harrylabsj); the current version is v1.0.2.
More Skills