yuntu-yw-shipping
Pass
Audited by Gen Agent Trust Hub on Jul 17, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill's architecture is focused on transparency and user control, with no evidence of malicious intent or hidden behaviors.
- [EXTERNAL_DOWNLOADS]: The skill connects to official logistics API endpoints for YunExpress (oms.api.yunexpress.com) and Yanwen (open.yw56.com.cn). These are recognized industry services required for the skill's documented shipping and tracking functions.
- [DATA_EXFILTRATION]: No exfiltration patterns were detected. The skill specifically instructs users to store API credentials in private local files and includes robust redaction logic in its scripts to prevent sensitive data like phone numbers, addresses, and API tokens from being exposed in chat logs.
- [COMMAND_EXECUTION]: The skill uses Python scripts to perform its tasks but maintains a 'human-in-the-loop' approach. State-changing operations (e.g., order creation) require an explicit
--executeflag and show a redacted preview first, preventing automated or accidental modifications.
Audit Metadata