Is pfrederiksen/shipment-tracker safe?
Yes. pfrederiksen/shipment-tracker is safe to install. Oathe's behavioral security audit gave the shipment-tracker skill by pfrederiksen a trust score of 91/100 with 3 findings, none critical or high.
https://github.com/pfrederiksen/shipment-tracker
Is pfrederiksen/shipment-tracker safe to install?
This is a legitimate package tracking skill that reads markdown files and queries carrier websites for shipping status. The code uses only standard library functions with no malicious behavior detected, and explicitly warns users about privacy implications of fallback browser-use features.
What security issues were found in pfrederiksen/shipment-tracker?
Category Scores
Findings (3)
MEDIUM Sensitive file access detected pre-installation -15 ▶
System monitoring detected access to sensitive files (.env, SSH keys, AWS credentials) at 07:05:38, but this occurred before the skill installation at 07:05:44. The accesses appear to be from system startup processes rather than the skill itself.
LOW Python script execution -10 ▶
The skill contains a Python script that performs package tracking functionality. The script uses only standard library imports and performs read-only operations on user-specified files and HTTP requests to carrier websites.
LOW Third-party data transmission via browser-use -15 ▶
The skill recommends using browser-use commands for tracking when HTTP parsing fails, which transmits package data to cloud services. However, this is explicitly documented with privacy warnings.
Should I install pfrederiksen/shipment-tracker?
Oathe's verdict for pfrederiksen/shipment-tracker is SAFE with a trust score of 91/100. Recommendation: Install.