📦 Logistics — 物流管理
v1.0.0一站式物流管理技能：追踪货运、优化路径、调度承运商、管理仓储、报关、退货、车队，并实时监控KPI。
0· 69·0 当前·0 累计
by @rithythul下载技能包
最后更新
2026/4/7
安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
This skill's behavior fits a logistics agent, but the metadata is incomplete: ask the publisher for a clear list of required API endpoints, environment variables, and the exact permissions it needs (read-only vs write) for each system (carrier APIs, TMS, ERP, dashboards). Do not provide broad org or admin credentials. Require least-privilege service accounts and explicit consent/authorization for any write operations (assigning drivers, booking shipments, generating POs). Test the skill in a sta...详细分析 ▾
ℹ 用途与能力
The SKILL.md describes standard logistics capabilities (tracking, routing, carriers, warehouses, KPIs) that match the skill name and description. However, many of those capabilities require access to external systems (carrier APIs, TMS, customer portals, internal dashboards) and credentials; the package declares no environment variables, credentials, or config paths. The omission makes it unclear how the skill would actually perform integrations.
⚠ 指令范围
Runtime instructions instruct the agent to 'pull latest tracking data from carrier API or TMS', 'ping carrier API', 'update customer-facing status portal and internal dashboard', 'assign drivers', 'generate booking confirmation and pickup request', and 'draft/retrieve customs documents'. These are high-impact actions that imply read/write access to external/internal systems and handling of sensitive data (orders, addresses, PII, contracts). The SKILL.md is vague about specific endpoints, authentication, and authorization checks, granting broad operational discretion to the agent.
✓ 安装机制
Instruction-only skill with no install spec and no code files; nothing is written to disk by an installer. This reduces risk from arbitrary downloads or package installs.
⚠ 凭证需求
There are no declared required env vars or primary credentials, yet the instructions expect access to carrier/TMS APIs, dashboards, and potentially internal systems. In practice this skill would need multiple credentials (carrier API keys, TMS credentials, DB or portal auth) and scoped permissions. The lack of declared secrets is a mismatch: either metadata is incomplete or the skill implicitly relies on agent-level credentials, which is a risk.
✓ 持久化与权限
The skill does not request 'always: true' and is user-invocable (normal). It does not declare modifications to other skills or system-wide settings in the SKILL.md. Autonomous model invocation is enabled by default (not a standalone flag), which is expected for skills but increases impact if the integration/access questions above are not resolved.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/7
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install koompi-logistics
镜像加速npx clawhub@latest install koompi-logistics --registry https://cn.longxiaskill.com