Zto

Use ZTO Express (中通快递) for shipment tracking, shipping guidance, service-type comparison, outlet lookup, and delivery-time or fee estimation. Use when the us...

What to consider before installing: - The skill appears to be a local ZTO helper that stores history, subscriptions, and optional encrypted files under ~/.openclaw/data/zto/. That behavior is declared in SKILL.md and implemented in code. - The SecureStorage implementation stores a Fernet key at ~/.openclaw/data/zto/secure/.key with file mode 600. While the data are encrypted, the key is stored locally; if an attacker can read your home directory they could decrypt the files. Avoid storing highly sensitive secrets (bank details, full identity documents) in the skill's storage. - The code imports aiohttp (networking). The visible query() simulates results, but the zto.py file was truncated in the listing — review the full file for any network calls or outbound endpoints before trusting it, especially any code that might transmit stored data to remote servers. - Dependencies are normal Python packages. Install into a virtualenv/sandbox if you want to reduce risk. - Use the provided privacy commands (privacy info / privacy clear / privacy export) to audit and remove data if you decide to try the skill. - If you do not trust the skill author or cannot inspect the entire zto.py file, treat it as untrusted code and run in an isolated environment. If you want, I can scan the remainder of zto.py (provide the full file) and specifically look for network endpoints, telemetry/callback code, or references to external hosts.

Type: OpenClaw Skill Name: zto Version: 1.0.0 The 'zto' skill is a legitimate tool for ZTO Express shipment tracking and logistics estimation. It uses local SQLite storage and a dedicated encryption module (security.py) to manage user history and subscriptions within the ~/.openclaw/ directory, all of which is clearly disclosed in SKILL.md. The code logic in zto.py is transparent, lacks any evidence of data exfiltration or unauthorized execution, and includes built-in privacy controls for users to inspect or clear their local data.