京东国际物流数据查询技能 核心能力：支持物流轨迹追踪、国际运营指标查询、跨境小包体验指标查询三大功能模块。 1.国际物流轨迹追踪技能 功能描述：查询国际物流单号的实时物流轨迹信息。 支持的单号类型： - FS 开头的京东订单号 - JDW 开头的京东运单号 - 客户运单号 - 承运商运单号 核心能力： - 实时查...

This skill largely does what it says (logistics tracking and indicators), but there are several red flags you should address before installing or providing any secret: - Do not set or expose any real API token until you confirm the exact env var name the skill expects. The code expects process.env.token or joy_token, but README suggests api_key in ~/.env — these must be reconciled. - The tracking script sends requests to lop-proxy.ochama.com rather than a jd.com domain. Ask the author why a third‑party proxy is used and request documentation proving it's an approved JD proxy. If you cannot verify, do not provide tokens. - The HTTPS requests set rejectUnauthorized: false, which disables TLS certificate verification. This weakens security and can enable man‑in‑the‑middle interception of tokens/responses. Request that the author remove this and use verified TLS. - If you must test, do so in an isolated environment with a throwaway token (no production credentials) and monitor outbound connections. Prefer to run the scripts in a network-restricted environment so they cannot reach unknown hosts until verified. - Ask the publisher to update the registry metadata to declare required env vars (exact names) and to justify any non-jd endpoints. If the author can prove the proxy is authorized and fix TLS settings and the env var mismatch, the concerns would be resolved and confidence would increase. If you want, I can draft specific questions to send to the author or produce a safe test plan to validate endpoints and env var usage.

Type: OpenClaw Skill Name: i-logisitics-skill Version: 1.0.1 The skill bundle is designed to query JD logistics and supply chain data but contains a recurring security vulnerability: `rejectUnauthorized: false` is explicitly set in the HTTPS request options within `get_cross_board_data.js`, `get_isc_data.js`, and `get_tracking_data.js`. This disables SSL certificate validation, making the API requests and the sensitive 'token' (passed in headers) vulnerable to Man-in-the-Middle (MitM) attacks. While the code logic appears aligned with its stated purpose, the use of insecure network configurations and the reliance on the AI agent to correctly sanitize inputs for shell command execution (as instructed in `SKILL.md`) warrants a suspicious classification.