yuntu-yw-shipping

SUSPICIOUS. The skill’s purpose and capabilities mostly align, and data appears intended for official carrier APIs, but the documented YunExpress HTTP endpoint materially weakens transport security for live carrier credentials. Overall this looks like a legitimate shipping skill with medium security risk rather than malware.