Shippo Clawhub Skill

(Beta) Ship packages with Shippo. Multi-carrier rate shopping, label generation, package tracking, address validation, customs declarations, and batch proces...

This skill appears to implement Shippo functionality and only asks for your SHIPPO_API_KEY, which is appropriate. Before installing or running it, check these things: (1) the SKILL.md expects Node.js >=18 and npx but the registry metadata did not declare required binaries — ensure your environment has Node and npx and understand that runtime will execute 'npx @shippo/shippo-mcp'. (2) npx will fetch and run an npm package on-demand; confirm the package (@shippo/shippo-mcp) and its source (npm/GitHub) are trustworthy and consider pinning a known-good version. (3) The MCP process is passed your API key on the command line (ShippoToken …); be aware local processes can potentially leak secrets if compromised. (4) Test initially with a shippo_test_* key (no charges) and review network activity / process behavior if you are in a sensitive environment. If you need higher assurance, ask the publisher for a signed release or an install spec that pins the MCP binary/version and declares the required binaries.

Type: OpenClaw Skill Name: shippo-official Version: 1.0.3 The shippo-official skill bundle is a legitimate integration for the Shippo shipping service via the Model Context Protocol (MCP). It provides comprehensive tools for address validation, rate shopping, label generation, and tracking. The instructions in SKILL.md explicitly include security safeguards, such as requiring a 'Purchase Confirmation Gate' before any financial transactions are executed. The skill uses the official Shippo API (api.goshippo.com) and follows standard patterns for local MCP server execution without any evidence of data exfiltration, malicious instructions, or obfuscation.