The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads and executes the @shopmeagent/logistics-tracking-mcp package from the npm registry using npx. This package is a remote dependency managed by the skill author.
[COMMAND_EXECUTION]: Instructions provided for both local and server-side deployment involve running npx commands to invoke the MCP server, which executes external code on the host machine.
[DYNAMIC_EXECUTION]: When used without an API key, the skill relies on the playwright package to launch a headless Chromium browser. This involves dynamic execution of a browser environment to scrape tracking data from t.17track.net.
[INDIRECT_PROMPT_INJECTION]: The skill represents a surface for indirect prompt injection as it ingests tracking information (status updates, timeline events, and location data) from external sources that are not under the direct control of the user or the skill.
Ingestion points: Data enters via the track_package and batch_track tools through 17track's API or web interface.
Boundary markers: The skill instructions do not define specific boundary markers or "ignore instructions" delimiters for the retrieved tracking data.
Capability inventory: The skill possesses network capabilities (via API and Playwright) and can output structured and natural language data to the agent.
Sanitization: There is no evidence of sanitization or filtering applied to the external tracking content before it is processed by the agent.

logistics-tracking