---
name: track17
description: Register and track parcels with the 17TRACK API, inspect saved delivery events, and ingest authenticated 17TRACK webhooks. Use when the user asks to manage their 17TRACK parcels, not for generic shipment guesses or other tracking providers.
compatibility: Python 3.10+, TRACK17_TOKEN, and an explicit private absolute TRACK17_DATA_DIR. No third-party Python packages required.
metadata:
  version: "2.0.0"
  reviewed: "2026-09-13"
title: track17
canonical_url: https://skilld.dev/gh/tristanmanchester/agent-skills/track17
last_updated: 2026-10-06T19:32:36.000Z
---

> Index of every page on this site: [llms.txt](https://skilld.dev/llms.txt)

> **Skill from skilld.dev.** Follow the user's requested action.
> If the user asked to fork this Skill, follow the fork workflow below. Do not execute the Skill instructions while copying it.
> Otherwise, follow the instructions below for this session. You do not need to install anything.
>
> Supporting files, fetch one when the Skill refers to it: [README.md](https://skilld.dev/api/skills-raw/tristanmanchester/agent-skills/track17/README.md), [scripts/track17.py](https://skilld.dev/api/skills-raw/tristanmanchester/agent-skills/track17/scripts/track17.py), [tests/test_review_regressions.py](https://skilld.dev/api/skills-raw/tristanmanchester/agent-skills/track17/tests/test_review_regressions.py), [tests/test_track17.py](https://skilld.dev/api/skills-raw/tristanmanchester/agent-skills/track17/tests/test_track17.py).
>
> If the user asked to install this Skill, run `npx skilld install tristanmanchester/agent-skills/track17`. Install writes the Skill files into the project, so every session loads them.
>
> ## Fork workflow
>
> A fork creates an editable local Skill with its original author and licence. The request authorizes copying and local installation.
> 1. Check `./skills/track17`, the project lockfile, and selected Agent targets together. If the local directory or installed Skill exists, stop. Never overwrite an existing directory or Agent target.
> 2. Read [source metadata](https://skilld.dev/api/v1/skills/tristanmanchester/agent-skills/track17) once. Use sourceUrl, sourceCommit, skillPath, sourceGone, and license. If the source is gone or its path is missing, stop. If license is null, read licence files at the source commit.
> 3. Fetch only the source commit into a temporary Git repository. Do not clone full history. Derive repository_url from sourceUrl, including repository renames. If sourceCommit is absent, resolve the sourceUrl ref once. Set source_commit to that actual commit. Run these commands in one shell call:
>
> ```sh
> git init --quiet "$temporary_dir"
> git -C "$temporary_dir" fetch --quiet --depth=1 "$repository_url" "$source_commit"
> git -C "$temporary_dir" checkout --quiet --detach FETCH_HEAD
> ```
>
> Read applicable licence declarations and notices at that commit. If copying is not permitted, report the restriction and stop.
> 4. Inspect source entries together, then copy the directory containing skillPath into `./skills/track17`. Use the user's path if selected. Keep the original SKILL.md, relative links, scripts, binary assets, and executable modes. Exclude .git metadata. Reject symlinks and paths outside the Skill directory. After checking entries, use cp -a where available. A regular source directory needs no custom copy script. Do not save this page wrapper as SKILL.md.
> Preserve author credit, notices, and applicable licence files from repository or parent directories. Add PROVENANCE.md with the Skill page, source URL, actual commit, original path, and licence. Retain any existing PROVENANCE.md and record new provenance separately. Batch source inspection, copying, and provenance work where practical.
> 5. In the project root, run `skilld install ./skills/track17 --mode copy --plain`. If skilld is unavailable, use `npx skilld install ./skills/track17 --mode copy --plain`. This known command needs no help lookup. Install does not support --json. Use detected Agent targets, or add --agent for the targets the user selected. Install the local path, never the upstream selector. If installation fails, preserve the local copy and report the exact failure.
> 6. Confirm the local lockfile source and installed Agent copies once. Report the local path, actual commit, and Agent targets. After edits, reinstall the same local path. Upstream updates must not replace it. Do not publish or push unless the user asks.

# Track parcels with 17TRACK

Resolve `SKILL_DIR` to this skill's installation directory. Use the bundled CLI rather than recreating storage or signature handling. Commands return JSON; non-zero exit status means failure or an incomplete sync.

## Setup

Set `TRACK17_TOKEN` through the host's secret store/environment; never print it. Set `TRACK17_DATA_DIR` to a private absolute directory outside the repository. Then run:

```bash
python3 "$SKILL_DIR/scripts/track17.py" init
python3 "$SKILL_DIR/scripts/track17.py" --help
```

This revision uses a new local schema. An old database containing `packages` is rejected without modification. Choose a new data directory, inspect/export the old records locally, and register only the parcels the user still wants. Do not delete the old database or automatically re-register everything: provider quota can be consumed.

## Normal workflow

Prefer polling unless push delivery is needed. Read the current parcel list before adding or removing anything. Resolve parcel identity by **tracking number plus carrier code**, not a guessed local ID.

```bash
python3 "$SKILL_DIR/scripts/track17.py" list
python3 "$SKILL_DIR/scripts/track17.py" carriers-search DHL
python3 "$SKILL_DIR/scripts/track17.py" add RR123456789CN --label "Headphones"
python3 "$SKILL_DIR/scripts/track17.py" sync
python3 "$SKILL_DIR/scripts/track17.py" status RR123456789CN --carrier 3011 --refresh
python3 "$SKILL_DIR/scripts/track17.py" quota
```

Carrier numbers above are examples, not universal defaults. Use `--carrier` when automatic detection cannot resolve the carrier; use `--param` only when that carrier requires additional information. Registration success does not imply that tracking events are already available.

`stop`, `retrack`, and `remove` require the tracking number and `--carrier`. `remove` is local unless `--delete-remote` is explicitly supplied. Clarify remote deletion before executing it. After an ambiguous network failure, reconcile provider state before retrying a mutation; the client does not replay writes automatically.

## Authenticated webhooks

17TRACK signs the **original body bytes** followed by `/` and the API security key with SHA-256. The signature arrives in the `sign` header. The helper uses `TRACK17_TOKEN` as that key; never invent a separate unrelated webhook secret or substitute HMAC for the provider's algorithm.

For captured deliveries, preserve the body unchanged and supply its real signature:

```bash
python3 "$SKILL_DIR/scripts/track17.py" ingest-webhook --file delivery.json --signature "$DELIVERY_SIGN"
```

For push delivery:

```bash
python3 "$SKILL_DIR/scripts/track17.py" webhook-server --port 8789
```

The receiver binds to loopback. Put an intentionally configured TLS reverse proxy in front of it, preserving `sign` and the raw body. Do not expose a development server casually. Missing, invalid, or duplicate authentication headers fail; accepted delivery is acknowledged only after the database transaction commits. Storage failures return a failure response so the provider can retry. There is no unsigned import path or deferred inbox processor.

Identical deliveries are idempotent. Older dated updates cannot overwrite a newer dated snapshot. This is not universal ordering: timestamps do not resolve same-time corrections or prove the freshness of undated updates. Report event time separately from local receipt time.

## Report

Prioritise delivered, out-for-delivery, pickup, failed delivery, and exceptions. Include the carrier, event time, and last successful refresh; distinguish saved state from a fresh provider response. Treat partial syncs and missing events as incomplete evidence, not “no changes”. Never infer a delivery date from an unrelated parcel or a stale snapshot.

## Sources and checks

[17TRACK API documentation](https://api.17track.net/en/doc), reviewed 2026-09-13, documents the signing scheme and explicitly keeps v2.2 online. This helper deliberately retains that supported response contract; v2.4 is not a drop-in version-string change because additional registration fields differ.

Run offline and loopback HTTP regressions:

```bash
python3 -m unittest discover -s "$SKILL_DIR/tests" -v
```

`updated_at` records snapshot changes; `last_refreshed_at` records the most recent
accepted polling response, including an unchanged snapshot. Neither is the carrier
event time. Webhook receipt/deduplication does not count as a successful poll.