京东国际物流数据查询技能 核心能力：支持物流轨迹追踪、国际运营指标查询、跨境小包体验指标查询三大功能模块。 1.国际物流轨迹追踪技能 功能描述：查询国际物流单号的实时物流轨迹信息。 支持的单号类型： - FS 开头的京东订单号 - JDW 开头的京东运单号 - 客户运单号 - 承运商运单号 核心能力： - 实时查...

This skill appears to implement JD logistics tracking and indicator queries, but there are several red flags you should address before installing or using it: - The code requires an environment variable named 'token' (used as an API auth header), but the skill metadata does not declare any required credentials. Do not set or export any sensitive token unless you know exactly which service issued it and trust the skill owner. - One tracking script posts to lop-proxy.ochama.com rather than an obvious jd.com API; confirm with the author/maintainer why this host is used and whether it is an authorized proxy. If you cannot verify the endpoint, do not provide real credentials. - All HTTPS requests set rejectUnauthorized: false (TLS certificate validation disabled). This allows connections to servers with invalid/forged certificates and makes man-in-the-middle attacks easier. Request that this be removed (set to true or omitted) before using with real secrets. - The skill assumes Node.js is available and instructs running local node scripts, but the registry metadata does not list node as a required binary. Ensure your environment is isolated (e.g., run in a sandbox) when testing. Recommended next steps before trusting this skill: 1. Ask the publisher to update registry metadata to declare the required 'token' env var and to explain the exact authority/scope of that token (which API it authenticates to). 2. Ask why lop-proxy.ochama.com is used and for proof that it is an approved proxy for JD services; replace it with official endpoints if possible. 3. Require the removal of rejectUnauthorized: false so TLS is validated. 4. Test in a safe environment with a non-production token and monitor network traffic to verify where requests go. If the author cannot satisfactorily explain the hostname and TLS settings, treat this skill as untrusted and avoid supplying real credentials.

Type: OpenClaw Skill Name: joy-logistics Version: 1.0.3 The skill bundle contains multiple Node.js scripts (get_cross_board_data.js, get_isc_data.js, and get_tracking_data.js) that explicitly disable SSL certificate validation by setting 'rejectUnauthorized: false', which is a significant security vulnerability allowing for man-in-the-middle (MITM) attacks. Additionally, the README.md provides instructions for users to hardcode a sensitive 'token' into their environment variables. While the scripts' logic appears consistent with the stated purpose of querying JD logistics data, the intentional bypass of standard security protocols and the handling of credentials make the bundle high-risk.