Index of every page on this site: llms.txt
All skills
tristanmanchester avatar

/track17

@3323bc9
by Tristan Manchestertristanmanchester/agent-skills3 stars
2
Run it yourself

Register and track parcels with the 17TRACK API, inspect saved delivery events, and ingest authenticated 17TRACK webhooks. Use when the user asks to manage their 17TRACK parcels, not for generic shipment guesses or other tracking providers.

Use this Skill: https://skilld.dev/gh/tristanmanchester/agent-skills/track17

Nothing lands on disk. Nothing to clean up.

Fork this Skill

Edit a local copy. It keeps the author and licence.

README.md

≈419 tokens on demand. Your agent reads this file only when SKILL.md points to it.

track17

A shell-agent skill for 17TRACK parcel registration, polling, delivery-event inspection, and authenticated webhook ingestion. Start with SKILL.md.

Requires Python 3.10+, TRACK17_TOKEN, and an explicit absolute TRACK17_DATA_DIR. No runtime packages are required. API calls are made only by commands that need provider access; the test suite uses synthetic inputs and a loopback HTTP server.

Revision 2

This revision removes optional authentication, success-before-persistence acknowledgements, implicit workspace storage discovery, local numeric-ID addressing, and the unsafe deferred inbox spooler. Webhooks are verified against the raw body and API key, deduplicated, and applied atomically before acknowledgement. Failed requests never count as successful syncs.

Storage uses a new schema. Old databases are detected and left unchanged; there is no automatic migration or silent reuse. Select a new data directory and deliberately re-register parcels still needed. Keep old data until you have exported and checked it.

The API remains v2.2 because 17TRACK explicitly supports it. The new v2.4 additional-field contract is not implemented by changing an endpoint string.

Validation

python3 -m unittest discover -s /absolute/path/to/track17/tests -v

Tests cover exact-byte signatures, invalid/missing authentication with no table changes, duplicate deliveries, transaction rollback, stale updates, malformed records, unconfirmed provider mutations, old-database preservation, HTTP authentication, and storage-failure responses. They do not establish live carrier/API availability or validate a production reverse proxy.

Source: SKILL.md on GitHub

Skill behaviors

skilld matched fixed text patterns in SKILL.md and file names. Patterns miss obfuscated code.

skilld run checks every file with the same patterns. It asks for approval before it loads a Skill with a behavior marked Needs approval.

Third-party checks

2 warnings1mo5 checks · Risk SAFE
  • Gen Agent Trust Hub1mo

    This skill is safe and functions as intended, allowing users to track parcels via the 17TRACK API. It uses a local SQLite database for storage and interacts with official 17TRACK domains. The 'low' verdict is due to the inherent surface for indirect prompt injection common in skills that process external data.

  • Socket1mo

    No alerts

  • Snyk1mo

    Risk: MEDIUM · 1 issue

  • Runlayer8mo

    3/3 files flagged

  • ZeroLeaks6mo

    Score: 93/100 · 2 sections analyzed

Provenance

Signed by skilld at 3323bc9. This ties the file your Agent reads to that commit on GitHub. It does not review the instructions.

Last checked against GitHub 2 weeks ago.

Steadyupdated last month

Capability

metadata
{
  "version": "2.0.0",
  "reviewed": "2026-09-13"
}
Other metadata
compatibility
Python 3.10+, TRACK17_TOKEN, and an explicit private absolute TRACK17_DATA_DIR. No third-party Python packages required.

README badge

README badge for tristanmanchester/agent-skills/track17