Query and explain parcel logistics across courier providers, including tracking, courier identification, multi-package lookup, status interpretation, and del...

What to consider before installing: - The skill will create a SQLite DB (~/.openclaw/data/logistics/logistics.db) and an encrypted storage area (~/.openclaw/data/logistics/secure) and will write a key file (.key) with 0600 perms. Expect persistent local data and encrypted blobs. If you don't want local persistence, don't install. - There is no install script; requirements.txt contains heavy native deps (cryptography, opencv, pyzbar). Make sure you trust the author and are prepared to install these packages (they may require system libraries). The absence of an explicit install step is an operational risk. - The secure storage code is intended to protect data but uses an odd key-derivation approach (PBKDF2 with random inputs) that looks buggy and may break or not yield a proper Fernet key. This appears to be sloppy/incorrect engineering rather than malicious, but it reduces confidence in the encryption correctness. - The current query() implementation returns simulated data and does not call external APIs, but the client contains an API_BASE and imports aiohttp — the code could be extended to make network calls (e.g., to kuaidi100) in future versions. If you need networked tracking, ask the author how API keys are handled and whether any outbound endpoints are contacted. - If you plan to install, review the code (especially secure storage and any networking) yourself or ask the author to explain: (1) why the KDF is used that way, (2) whether any external endpoints are contacted and how API keys are stored/used, and (3) provide an explicit install mechanism or containerized packaging to avoid surprise native installs. - If you are uncomfortable with local file writes or installing native libs, avoid installing this skill or run it in a restricted environment (container or VM).

Type: OpenClaw Skill Name: logistics Version: 1.0.2 The logistics skill is a well-structured tool designed to track parcel delivery statuses across various Chinese couriers. It features a local SQLite database for history tracking and a custom 'security.py' module that uses Fernet encryption to protect stored data. While the 'requirements.txt' file includes several unused dependencies related to image processing (e.g., opencv-python, pyzbar), the core logic in 'logistics.py' is functional, uses parameterized SQL queries to prevent injection, and restricts file operations to its own data directory. No evidence of malicious intent, data exfiltration, or prompt injection was found.