Rastreie pacotes e encomendas dos Correios usando a API oficial com consultas por código, histórico e favoritos via comandos simples.

This skill's code implements Correios tracking and asks you to set CORREIOS_API_KEY — that is expected. However, the package metadata omitted the required env var and did not list Node.js as a runtime requirement; treat that as a sign the package metadata is incomplete. Before installing: (1) verify you will run it in a trusted environment with Node.js installed, (2) set CORREIOS_API_KEY in an environment you control (don't paste keys into public places), (3) be aware it stores history/favorites in a local data.json file inside the package folder (remove or inspect it if you don't want tracking codes saved), and (4) inspect the included src/index.js yourself (or run in a sandbox) — there are minor bugs/typos in the code (undefined variable used when formatting results) but no obvious exfiltration endpoints beyond the official Correios API. If you need metadata corrected (declare CORREIOS_API_KEY and Node as requirements), ask the publisher for an updated package before trusting it.

Type: OpenClaw Skill Name: correios-rastreio Version: 1.0.0 The skill is a legitimate tool for tracking Brazilian postal service (Correios) packages using their official API (api.correios.com.br). It handles authentication via an environment variable and maintains a local history/favorites file (src/data.json). While there is a minor coding bug in src/index.js (an undefined variable 'ultimohora' in the output formatting), there are no signs of malicious intent, data exfiltration, or prompt injection.