ops-package
What this skill does
A shipping utility that allows users to ship parcels via multiple carriers (DHL, DPD, FedEx, MyParcel, PostNL, SendCloud, UPS) by using their respective API credentials. It automatically selects the f
github/davepoon - Data Exfiltration - 3.3k stars
Threat analysis
Skill info
pkg:github/davepoon/buildwithclaude@faa769d?skill=ops-packageAssessments (7)
Data Exfiltration
Data Exfiltration via local-llm-review
lib/carriers/dhl.sh
The script uses `curl` to send data to the DHL API endpoint for authentication, which may include sensitive credentials (userId and key) in the request body. These credentials are resolved from enviroData Exfiltration via local-llm-review
lib/carriers/dpd.sh
The script uses `curl` to send data to the DPD API endpoint for authentication, which may include sensitive credentials (delisId and password) in the request body. These credentials are resolved from Data Exfiltration via local-llm-review
lib/carriers/fedex.sh
The script uses `curl` to send data to the FedEx API endpoint for authentication, which may include sensitive credentials (client ID, client secret, and account number) in the request body. These credData Exfiltration via local-llm-review
lib/carriers/myparcel.sh
The script uses `curl` to send data to the MyParcel API endpoint for shipping, which may include sensitive credentials (api_key) in the request header. These credentials are resolved from environment Data Exfiltration via local-llm-review
lib/carriers/postnl.sh
The script uses `curl` to send data to the PostNL API endpoint for shipping, which may include sensitive credentials in the request header. These credentials are resolved from environment variables, wData Exfiltration via local-llm-review
lib/carriers/sendcloud.sh
The script uses `curl` to send data to the SendCloud API endpoint for shipping, which may include sensitive credentials in the request header. These credentials are resolved from environment variablesData Exfiltration via local-llm-review
lib/carriers/ups.sh
The script uses `curl` to send data to the UPS API endpoint for authentication, which may include sensitive credentials (b64) in the request body. These credentials are resolved from environment variaBadge
Add the Anomity scan badge for ops-package to your README.
How Anomity governs this at runtime
Scan-time vetting tells you what a skill says it will do. Anomity's Endpoint Sensor sees what agents actually do: it discovers skills alongside every other AI artifact on the endpoint, and runtime governance can allow, deny, or log the tool calls a skill triggers. Policy violations route to your SIEM, Slack, email, or Jira, backed by a queryable 90-day audit trail.
Book a 30-minute demo to see your own skill inventory.
Methodology and disputes
Every skill is assessed by the Anomity Skill Intelligence engine against its public source; findings indicate risk patterns, not confirmed exploitation. Maintainer of ops-package? Report an issue or request a rescan.
