Index of every page on this site: llms.txt
All skills
tristanmanchester avatar

/track17

@3323bc9
by Tristan Manchestertristanmanchester/agent-skills3 stars
2
Run it yourself

Register and track parcels with the 17TRACK API, inspect saved delivery events, and ingest authenticated 17TRACK webhooks. Use when the user asks to manage their 17TRACK parcels, not for generic shipment guesses or other tracking providers.

Use this Skill: https://skilld.dev/gh/tristanmanchester/agent-skills/track17

Nothing lands on disk. Nothing to clean up.

Fork this Skill

Edit a local copy. It keeps the author and licence.

SKILL.md

≈62 tokens for metadata: the name and description. ≈1.1k when used: this file. ≈419 more on demand in 1 file.

Description uses 3.1% of example budget

Before choosing a Skill, your Agent reads its name and description. All available Skills share that space.

  • A shorter description leaves more room for other Skills. This entry exceeds our 1% size suggestion.

In our Claude Code example, all Skill names and descriptions share 8,000 characters. This Skill uses ≈250 characters, or 3.1%.

The 1% threshold is a size suggestion. Longer descriptions can still fit.

Your model, settings, and other Skills decide how much text your Agent can read.

Example settings and source

The example uses a 200k-token context and default Claude Code settings. The count includes the name, description, separators, and when_to_use when present. Codex also counts local file paths.

Skit's source and limits: Codex 0.160.1, Claude Code 2.1.292.

Track parcels with 17TRACK

Resolve SKILL_DIR to this skill's installation directory. Use the bundled CLI rather than recreating storage or signature handling. Commands return JSON; non-zero exit status means failure or an incomplete sync.

Setup

Set TRACK17_TOKEN through the host's secret store/environment; never print it. Set TRACK17_DATA_DIR to a private absolute directory outside the repository. Then run:

python3 "$SKILL_DIR/scripts/track17.py" init
python3 "$SKILL_DIR/scripts/track17.py" --help

This revision uses a new local schema. An old database containing packages is rejected without modification. Choose a new data directory, inspect/export the old records locally, and register only the parcels the user still wants. Do not delete the old database or automatically re-register everything: provider quota can be consumed.

Normal workflow

Prefer polling unless push delivery is needed. Read the current parcel list before adding or removing anything. Resolve parcel identity by tracking number plus carrier code, not a guessed local ID.

python3 "$SKILL_DIR/scripts/track17.py" list
python3 "$SKILL_DIR/scripts/track17.py" carriers-search DHL
python3 "$SKILL_DIR/scripts/track17.py" add RR123456789CN --label "Headphones"
python3 "$SKILL_DIR/scripts/track17.py" sync
python3 "$SKILL_DIR/scripts/track17.py" status RR123456789CN --carrier 3011 --refresh
python3 "$SKILL_DIR/scripts/track17.py" quota

Carrier numbers above are examples, not universal defaults. Use --carrier when automatic detection cannot resolve the carrier; use --param only when that carrier requires additional information. Registration success does not imply that tracking events are already available.

stop, retrack, and remove require the tracking number and --carrier. remove is local unless --delete-remote is explicitly supplied. Clarify remote deletion before executing it. After an ambiguous network failure, reconcile provider state before retrying a mutation; the client does not replay writes automatically.

Authenticated webhooks

17TRACK signs the original body bytes followed by / and the API security key with SHA-256. The signature arrives in the sign header. The helper uses TRACK17_TOKEN as that key; never invent a separate unrelated webhook secret or substitute HMAC for the provider's algorithm.

For captured deliveries, preserve the body unchanged and supply its real signature:

python3 "$SKILL_DIR/scripts/track17.py" ingest-webhook --file delivery.json --signature "$DELIVERY_SIGN"

For push delivery:

python3 "$SKILL_DIR/scripts/track17.py" webhook-server --port 8789

The receiver binds to loopback. Put an intentionally configured TLS reverse proxy in front of it, preserving sign and the raw body. Do not expose a development server casually. Missing, invalid, or duplicate authentication headers fail; accepted delivery is acknowledged only after the database transaction commits. Storage failures return a failure response so the provider can retry. There is no unsigned import path or deferred inbox processor.

Identical deliveries are idempotent. Older dated updates cannot overwrite a newer dated snapshot. This is not universal ordering: timestamps do not resolve same-time corrections or prove the freshness of undated updates. Report event time separately from local receipt time.

Report

Prioritise delivered, out-for-delivery, pickup, failed delivery, and exceptions. Include the carrier, event time, and last successful refresh; distinguish saved state from a fresh provider response. Treat partial syncs and missing events as incomplete evidence, not “no changes”. Never infer a delivery date from an unrelated parcel or a stale snapshot.

Sources and checks

17TRACK API documentation, reviewed 2026-09-13, documents the signing scheme and explicitly keeps v2.2 online. This helper deliberately retains that supported response contract; v2.4 is not a drop-in version-string change because additional registration fields differ.

Run offline and loopback HTTP regressions:

python3 -m unittest discover -s "$SKILL_DIR/tests" -v

updated_at records snapshot changes; last_refreshed_at records the most recent accepted polling response, including an unchanged snapshot. Neither is the carrier event time. Webhook receipt/deduplication does not count as a successful poll.

Source: SKILL.md on GitHub

Skill behaviors

skilld matched fixed text patterns in SKILL.md and file names. Patterns miss obfuscated code.

skilld run checks every file with the same patterns. It asks for approval before it loads a Skill with a behavior marked Needs approval.

Third-party checks

2 warnings1mo5 checks · Risk SAFE
  • Gen Agent Trust Hub1mo

    This skill is safe and functions as intended, allowing users to track parcels via the 17TRACK API. It uses a local SQLite database for storage and interacts with official 17TRACK domains. The 'low' verdict is due to the inherent surface for indirect prompt injection common in skills that process external data.

  • Socket1mo

    No alerts

  • Snyk1mo

    Risk: MEDIUM · 1 issue

  • Runlayer8mo

    3/3 files flagged

  • ZeroLeaks6mo

    Score: 93/100 · 2 sections analyzed

Provenance

Signed by skilld at 3323bc9. This ties the file your Agent reads to that commit on GitHub. It does not review the instructions.

Last checked against GitHub 2 weeks ago.

Steadyupdated last month

Capability

metadata
{
  "version": "2.0.0",
  "reviewed": "2026-09-13"
}
Other metadata
compatibility
Python 3.10+, TRACK17_TOKEN, and an explicit private absolute TRACK17_DATA_DIR. No third-party Python packages required.

README badge

README badge for tristanmanchester/agent-skills/track17