uupt-delivery

UU跑腿同城配送服务。支持订单询价、发单下单、查询订单、取消订单、骑手实时追踪。当用户表达任何与"送"、"取"、"寄"、"跑腿"、"发单"、"配送"相关的配送需求时使用此skill。

What to consider before installing: - The skill is functionally a delivery client and its code matches the description, but it ships with defaults.json containing an appId/appSecret. Treat those as sensitive: prefer replacing them with your own credentials or removing them if you do not trust the publisher. - Registration requires your phone number and the skill will automatically fetch your public IP (it contacts external IP services such as httpbin.org, ipinfo.io, api.ipify.org). If you have privacy concerns, do not provide your phone or run this skill in a network-isolated environment. - The skill will create orders immediately after pricing and explicitly states it will not ask for a second confirmation. Creating orders can incur charges or commitments—confirm with the user before allowing the agent to perform 'create order' actions or modify the SKILL.md/skill logic to require explicit confirmation. - The skill writes credentials/openId to a local config.json in the skill directory. If you use shared systems, ensure file permissions are appropriate or run the skill in a controlled environment. - Network endpoints used by the skill include: api-open.uupt.com (primary API), public IP services (httpbin.org, ipinfo.io, api.ipify.org), and api.qrserver.com (QR generation). If you need stronger guarantees, audit requests and replace defaults with your own account. - If you want this to be considered lower-risk: ask the publisher to remove packaged secrets, require an explicit confirmation step before creating orders, and document why public-IP lookup is necessary and whether it can be disabled. If the publisher confirms defaults.json only contains non-sensitive demo keys and provides a way to opt-out, the concerns would be reduced.

Type: OpenClaw Skill Name: uupt-delivery Version: 1.0.11 The skill provides a legitimate integration with the UU跑腿 (UU Delivery) same-city delivery service, supporting price inquiries, order creation, and driver tracking. It includes both Node.js and Python implementations that interact with the official UU跑腿 OpenAPI (api-open.uupt.com). While the skill collects the user's public IP via services like ipify.org or ipinfo.io, this is a documented requirement for the service's SMS verification and anti-fraud registration process. The instructions in SKILL.md guide the AI agent through a standard OAuth-like registration flow and order management, and the inclusion of default credentials in defaults.json appears to be a legitimate 'quick start' feature provided by the developer.