← 返回 Skills 市场
国际平台组测试合集
作者
jdl-external-skills
· GitHub ↗
· v1.0.0
· MIT-0
80
总下载
0
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install iplat-test-skill
功能描述
京东国际物流数据查询技能 核心能力：支持物流轨迹追踪、国际运营指标查询、跨境小包体验指标查询三大功能模块。 1.国际物流轨迹追踪技能 功能描述：查询国际物流单号的实时物流轨迹信息。 支持的单号类型： - FS 开头的京东订单号 - JDW 开头的京东运单号 - 客户运单号 - 承运商运单号 核心能力： - 实时查...
使用说明 (SKILL.md)
joy-logistics-skill — 国际物流 Skills 全集
Complete collection of multi Logistics skills for OpenClaw agents.
Included Skills
| Skill | Category | Description |
|---|---|---|
| joy-logistics-trace | logistics-trace-query | 国际物流轨迹明细查询 |
| joy-logistics-indicator | indicators-query | 国际供应链、跨境小包相关指标查询 |
Documentation
See README.md for the complete setup guide (in Chinese).
安全使用建议
Before installing or running this skill, verify the publisher and endpoints: ask whether lop-proxy.ochama.com is an approved JD proxy. Do not provide real JD credentials or tokens until you confirm the correct environment variable name and intended endpoint. Prefer to run the bundled scripts in an isolated/test environment and inspect network traffic (or run with a dummy token) to confirm where requests go. Also ask the author to (1) declare the required env var explicitly, (2) remove or explain any code that disables TLS verification (rejectUnauthorized: false), and (3) replace any third‑party host with an official JD API endpoint or provide documentation proving the proxy is legitimate. If you cannot confirm these, treat the skill as untrusted.
功能分析
Type: OpenClaw Skill
Name: iplat-test-skill
Version: 1.0.0
The skill bundle provides legitimate tools for querying JD International logistics and supply chain data. However, the implementation in 'get_cross_board_data.js', 'get_isc_data.js', and 'get_tracking_data.js' explicitly disables SSL certificate validation ('rejectUnauthorized: false'), which is a significant security vulnerability that exposes the agent to man-in-the-middle (MITM) attacks. While the network requests are directed to legitimate JD.com and Ochama domains (us-api.jd.com, lop-proxy.ochama.com), the intentional bypass of security protocols warrants a suspicious classification.
能力标签
能力评估
Purpose & Capability
The stated purpose is querying JD international logistics and related metrics, and most files implement HTTP POST calls to JD-like APIs (us-api.jd.com). However the tracking script sends requests to lop-proxy.ochama.com (not a JD domain) while setting headers that impersonate JD (LOP-DN: ifop.skill.eu.outer.jd.com). This third-party endpoint is not justified by the description and is unusual for a JD integration.
Instruction Scope
Runtime instructions tell the agent to run local Node scripts that send user-supplied identifiers to external APIs. The SKILL.md and README do not declare the required environment variable(s) even though the scripts read process.env.token; the README shows inconsistent variable names (api_key vs token). The SKILL.md enforces strict CLI invocation which limits arbitrary behavior, but the code will attach an env token header to external endpoints and will proceed even with TLS verification disabled, which expands impact beyond the described scope.
Install Mechanism
No install spec is present (instruction-only install), so nothing is automatically downloaded during installation. Code files are bundled with the skill which will be executed by the agent when invoked; no external installer URLs or archives are used.
Credentials
The skill does not declare required env vars but the scripts require a token (process.env.token) and the README suggests storing credentials in ~/.env. Variable naming is inconsistent (README shows api_key example, Windows example uses token). The single token credential would be proportionate for calling JD APIs, except that the token is sent to a non-JD host (lop-proxy.ochama.com) in one script, increasing the risk that a secret is exfiltrated.
Persistence & Privilege
The skill does not request persistent/always-on privileges (always:false) and does not attempt to modify other skills or system-wide configuration. Autonomous invocation is allowed by platform default; combined with the other concerns this raises the blast radius but is not in itself a policy violation.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install iplat-test-skill - 安装完成后，直接呼叫该 Skill 的名称或使用
/iplat-test-skill触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.0
Initial release of iplat-test-skill for 京东国际物流数据查询.
- Supports real-time tracking for various international logistics tracking numbers.
- Enables querying and comparative analysis of a wide range of supply chain and cross-border package KPIs.
- Integrates logistics trajectory tracking and operational indicators into one skill.
元数据
常见问题
国际平台组测试合集 是什么？
京东国际物流数据查询技能 核心能力：支持物流轨迹追踪、国际运营指标查询、跨境小包体验指标查询三大功能模块。 1.国际物流轨迹追踪技能 功能描述：查询国际物流单号的实时物流轨迹信息。 支持的单号类型： - FS 开头的京东订单号 - JDW 开头的京东运单号 - 客户运单号 - 承运商运单号 核心能力： - 实时查... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 80 次。
如何安装 国际平台组测试合集？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install iplat-test-skill」即可一键安装，无需额外配置。
国际平台组测试合集 是免费的吗？
是的，国际平台组测试合集 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
国际平台组测试合集 支持哪些平台？
国际平台组测试合集 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 国际平台组测试合集？
由 jdl-external-skills（@jdl-external-skills）开发并维护，当前版本 v1.0.0。
推荐 Skills