快递监控Skill - 查询快递物流、绑定手机号自动获取快递、同步到飞书

This skill's description over-promises: it mentions encrypted phone storage, automatic retrieval by bound phone, and syncing to Feishu, but the shipped Python implements only manual tracking queries, phone binding stored as plain JSON, and no Feishu integration. If you need the advertised features, ask the author for a corrected version or inspect and modify the code yourself (e.g., add encryption for PHONE_FILE, implement Feishu webhook/token handling, and implement phone-based retrieval using an appropriate API). Before installing/use: (1) review the express_monitor.py source yourself (it is included), (2) be aware it will create and write files to ~/.openclaw/workspace/data/express and stores phone numbers in plaintext, (3) run it in a sandbox/container if you are concerned about data privacy, and (4) ensure the Python 'requests' library is installed. If you expect automatic push-to-Feishu or encrypted storage, do not rely on this package as-is.

Type: OpenClaw Skill Name: express-monitor Version: 1.0.0 The skill provides legitimate express tracking functionality by querying the public Kuaidi100 API. It manages tracking history and user-provided phone numbers locally in the `~/.openclaw/workspace/data/express/` directory. Although `SKILL.md` incorrectly claims that phone numbers are stored with encryption (they are stored in plain JSON in `phones.json`), the code in `express_monitor.py` lacks any indicators of data exfiltration, malicious execution, or unauthorized access.