track17
Register and track parcels with the 17TRACK API, inspect saved delivery events, and ingest authenticated 17TRACK webhooks. Use when the user asks to manage their 17TRACK parcels, not for generic shipment guesses or other tracking providers.
- Installs
- 102
- Last 24h
- —
- Trending rank
- —
- Security
- Not audited
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/tristanmanchester/agent-skills --skill track17- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads track17 automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
Track parcels with 17TRACK
Resolve SKILL_DIR to this skill's installation directory. Use the bundled CLI rather than recreating storage or signature handling. Commands return JSON; non-zero exit status means failure or an incomplete sync.
Setup
Set TRACK17_TOKEN through the host's secret store/environment; never print it. Set TRACK17_DATA_DIR to a private absolute directory outside the repository. Then run:
python3 "$SKILL_DIR/scripts/track17.py" init
python3 "$SKILL_DIR/scripts/track17.py" --help
This revision uses a new local schema. An old database containing packages is rejected without modification. Choose a new data directory, inspect/export the old records locally, and register only the parcels the user still wants. Do not delete the old database or automatically re-register everything: provider quota can be consumed.
Normal workflow
Prefer polling unless push delivery is needed. Read the current parcel list before adding or removing anything. Resolve parcel identity by tracking number plus carrier code, not a guessed local ID.
python3 "$SKILL_DIR/scripts/track17.py" list
python3 "$SKILL_DIR/scripts/track17.py" carriers-search DHL
python3 "$SKILL_DIR/scripts/track17.py" add RR123456789CN --label "Headphones"
python3 "$SKILL_DIR/scripts/track17.py" sync
python3 "$SKILL_DIR/scripts/track17.py" status RR123456789CN --carrier 3011 --refresh
python3 "$SKILL_DIR/scripts/track17.py" quota
Carrier numbers above are examples, not universal defaults. Use --carrier when automatic detection cannot resolve the carrier; use --param only when that carrier requires additional information. Registration success does not imply that tracking events are already available.
stop, retrack, and remove require the tracking number and --carrier. remove is local unless --delete-remote is explicitly supplied. Clarify remote deletion before executing it. After an ambiguous network failure, reconcile provider state before retrying a mutation; the client does not replay writes automatically.
Authenticated webhooks
17TRACK signs the original body bytes followed by / and the API security key with SHA-256. The signature arrives in the sign header. The helper uses TRACK17_TOKEN as that key; never invent a separate unrelated webhook secret or substitute HMAC for the provider's algorithm.
For captured deliveries, preserve the body unchanged and supply its real signature:
python3 "$SKILL_DIR/scripts/track17.py" ingest-webhook --file delivery.json --signature "$DELIVERY_SIGN"
For push delivery:
python3 "$SKILL_DIR/scripts/track17.py" webhook-server --port 8789
The receiver binds to loopback. Put an intentionally configured TLS reverse proxy in front of it, preserving sign and the raw body. Do not expose a development server casually. Missing, invalid, or duplicate authentication headers fail; accepted delivery is acknowledged only after the database transaction commits. Storage failures return a failure response so the provider can retry. There is no unsigned import path or deferred inbox processor.
Identical deliveries are idempotent. Older dated updates cannot overwrite a newer dated snapshot. This is not universal ordering: timestamps do not resolve same-time corrections or prove the freshness of undated updates. Report event time separately from local receipt time.
Report
Prioritise delivered, out-for-delivery, pickup, failed delivery, and exceptions. Include the carrier, event time, and last successful refresh; distinguish saved state from a fresh provider response. Treat partial syncs and missing events as incomplete evidence, not “no changes”. Never infer a delivery date from an unrelated parcel or a stale snapshot.
Sources and checks
17TRACK API documentation, reviewed 2026-09-13, documents the signing scheme and explicitly keeps v2.2 online. This helper deliberately retains that supported response contract; v2.4 is not a drop-in version-string change because additional registration fields differ.
Run offline and loopback HTTP regressions:
python3 -m unittest discover -s "$SKILL_DIR/tests" -v
updated_at records snapshot changes; last_refreshed_at records the most recent
accepted polling response, including an unchanged snapshot. Neither is the carrier
event time. Webhook receipt/deduplication does not count as a successful poll.
FAQ
What does the track17 skill do?
Register and track parcels with the 17TRACK API, inspect saved delivery events, and ingest authenticated 17TRACK webhooks. Use when the user asks to manage their 17TRACK parcels, not for generic shipment guesses or other tracking providers.
How do I install track17?
Run npx skills add https://github.com/tristanmanchester/agent-skills --skill track17 in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/track17/ (personal) or .claude/skills/track17/ (project).
Which AI agents can use track17?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is track17 safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains track17?
It is published by tristanmanchester in tristanmanchester/agent-skills. It has 102 recorded installs.
More from tristanmanchester/agent-skills
designing-beautiful-websites
tristanmanchester/agent-skills
Design, implement, or critique website and web-app UX/UI: information structure, user flows, responsive layouts, visual systems, content, and interaction states. Use for a requested interface or visual-design change; do not expand a small component edit into an unrequested product redesign.
reddit-readonly
tristanmanchester/agent-skills
Browse and search Reddit in read-only mode using public JSON endpoints. Use when the user asks to browse subreddits, search for posts by topic, inspect comment threads, or build a shortlist of links to review and reply to manually.
animating-react-native-expo
tristanmanchester/agent-skills
Implement and debug React Native or Expo motion with Reanimated 4 and Gesture Handler 3: state transitions, layout, gestures, scroll, worklets, cancellation, and accessible alternatives. Use for native UI motion, not web Motion or a reason to add canvas graphics to ordinary views.
styling-nativewind-v4-expo
tristanmanchester/agent-skills
Open the skill to read its SKILL.md instructions.
nextjs-framer-motion-animations
tristanmanchester/agent-skills
Open the skill to read its SKILL.md instructions.
react-native-skia
tristanmanchester/agent-skills
Build, debug, or profile React Native Skia canvases, paths, rich text, shaders, images, snapshots, video, and animated graphics. Use when Skia is selected or custom drawing is needed. Do not introduce a canvas merely because ordinary native UI should look polished or animate smoothly.
Popular backend & apis skills
find-skills
vercel-labs/skills
Helps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skill should be used when the user is looking for functionality that might exist as an installable skill.
entra-app-registration
microsoft/azure-skills
Guides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API permissions, generate service principal, MSAL example, console app auth, Entra ID setup, Azure AD authentication. DO NOT USE FOR: Key Vault secrets (use azure-keyvault-expiration-audit), general Azure resource security guidance.
google-agents-cli-adk-code
google/agents-cli
This skill should be used when the user wants to "write agent code", "build an agent with ADK", "add a tool", "create a callback", "define an agent", "use state management" — in a project that needs ADK (Agent Development Kit) API patterns and code examples. It provides a quick reference for agent types, tool definitions, orchestration patterns, callbacks, state management, the graph Workflow API, and reference recipes to study. Do NOT use for scaffolding (use google-agents-cli-scaffold) or deployment (use google-agents-cli-deploy).
embedded-captions
heygen-com/hyperframes
Add captions or subtitles to an existing single-subject talking-head video without editing the footage. Use for plain verbatim captions, cinematic captions embedded behind the subject, VFX captions, “炸/特效/酷炫字幕,” or a named identity from the 35-style catalog. Route by visual identity, not by backend engine. The quiet anchor rail is the default; embed every word only when the user explicitly wants a fully cinematic treatment. The workflow runs locally end to end, including transcription and subject matting; split multi-shot footage before applying it.
entra-agent-id
microsoft/azure-skills
Provision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2.0 token exchange (fmipath, OBO, cross-tenant) including the Microsoft Entra SDK for AgentID sidecar. USE FOR: Agent Identity Blueprint, BlueprintPrincipal, agent OAuth, fmipath token exchange, agent OBO, Workload Identity Federation for agents, polyglot agent auth, Microsoft.Identity.Web.AgentIdentities. DO NOT USE FOR: standard Entra app registration (use entra-app-registration), Microsoft Foundry agent authoring (use microsoft-foundry).
neon
neondatabase/agent-skills
Overview of Neon, a complete set of cloud backend primitives around Lakebase Postgres: Auth, Object Storage, Functions, the AI Gateway, and Realtime. Start here to choose Neon for undecided login, files, APIs, and LLM calls, set up the CLI or MCP server, and follow the branch-first workflow. Use when building an app or backend on Neon, or when "Neon" or "Lakebase Postgres" is mentioned. Child skill neon-postgres wins for an existing DATABASEURL, SQL, schema, inspect, or search. Child skill neon-auth wins for login, users, sessions, identity routing, and Managed Better Auth setup. Child skill neon-realtime wins for live queries in reactive apps and agents. Also use for object storage, S3, buckets, serverless functions, function triggers, cron, AI gateway, LLM calls, realtime, logs, Loki, Grafana, observability, postgres, database, backend, Claimable Neon, neon.new, or a no-signup database.