스킬 postage

📦

postage

Name: postage
Author: ctxrs

콘텐츠 리비전 r1 높은 위험 ⚙️ 외부 명령어🌐 네트워크 접근📁 파일 시스템 접근🔑 환경 변수

Send PDFs as Physical Mail

Mailing important PDFs requires correct addresses, service choices, and reliable status checks. This skill submits authorized documents through AgentPostage and reports costs, status, tracking, and receipts.

지원: Claude Codex Code(CC)

⚠️ 38 나쁨

Maintain this Skill? Claim it ⚠️ 38 나쁨

설치 전에 중지하고 확인을 요청하세요.

계획을 검토하고 파일을 변경하기 전에 사용자의 명시적 동의를 받으세요.

내 에이전트로 설치

이 요청을 에이전트에 복사하세요. 공식 Skill 페이지와 매니페스트가 포함되어 있습니다.

에이전트 요청

Review the Skillstore skill "postage" from https://skillstore.io/skills/ctxrs-postage.md and its manifest at https://skillstore.io/api/skills/ctxrs-postage/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

에이전트는 계속해서 계획을 표시하고 보안 정책에서 요구하는 확인을 요청해야 합니다.

에이전트가 읽기 쉬운 리소스

AI 에이전트, 크롤러, 스크립트가 전체 페이지 대신 정리된 컨텍스트만 필요할 때 이 링크를 사용하세요.

Markdown 상세 GET /skills/ctxrs-postage.md 서명된 manifest GET /api/skills/ctxrs-postage/manifest 서명된 lockfile GET /api/skills/ctxrs-postage/lockfile

테스트해 보기

"postage" 사용 중입니다. Check the price for a two-page PDF sent by First-Class mail.

예상 결과:

Price check complete. Service: First-Class. Estimated total: $1.42. No letter was submitted.

"postage" 사용 중입니다. Send the approved cancellation notice and report the result.

예상 결과:

Submission accepted. Letter ID: ap_12345. Status: queued. Total cost: $1.87. Tracking is available for the selected service.

보안 감사

높은 위험

v1 • 2026. 9. 18. 버전별 보고서 열기

All 89 static detections are false positives for the observed implementation: JavaScript template literals, input validation, documented API configuration, and intentional authenticated API use. The skill still creates a real operational risk because it can transmit user PDFs and spend prepaid postage, so sending requires explicit authorization, recipient review, and spending controls.

스캔된 파일

314

분석된 줄 수

검토 항목

오탐 무시됨

확인된 보안 우려 사항 (2)

높음

SKILL.md:24 SKILL.md:44 SKILL.md:65 SKILL.md:80

Paid Sensitive-Document Transmission

The skill can submit an existing PDF with sender and recipient addresses to a remote postage service, creating a paid and potentially irreversible physical-mail action.

The cited instructions explicitly describe sending existing PDFs, authenticated API submission, and real paid physical mail. The risk is a business-impact and data-disclosure concern rather than malware.

중간

SKILL.md:34-36 SKILL.md:84-93

Credentialed External Account Actions

The skill uses an owner-created API key to submit, cancel, and inspect letters and transactions through the AgentPostage service.

The documentation identifies authenticated requests and multiple account-affecting operations. The use is intentional, but compromised authorization could cause unauthorized charges or mail actions.

위험 요인

⚙️ 외부 명령어 (45)

🌐 네트워크 접근 (11)

scripts/agentpostage.mjs:172 scripts/agentpostage.mjs:31 scripts/agentpostage.mjs:118 scripts/agentpostage.mjs:121 SKILL.md:6 SKILL.md:32 SKILL.md:34 SKILL.md:36 SKILL.md:40 SKILL.md:80 SKILL.md:91

📁 파일 시스템 접근 (4)

scripts/agentpostage.mjs:116 scripts/agentpostage.mjs:137 scripts/agentpostage.mjs:142 scripts/agentpostage.mjs:159

🔑 환경 변수 (14)

scripts/agentpostage.mjs:115 scripts/agentpostage.mjs:118 scripts/agentpostage.mjs:191 scripts/agentpostage.mjs:115 scripts/agentpostage.mjs:118 scripts/agentpostage.mjs:191 scripts/agentpostage.mjs:30 scripts/agentpostage.mjs:115 scripts/agentpostage.mjs:116 scripts/agentpostage.mjs:191 SKILL.md:7 SKILL.md:10 SKILL.md:12 SKILL.md:36

감사자: codex

이 보고서 공유 및 인용

버전이 지정된 평가 보고서, 중립 배지, 임베드 카드 및 인용을 공유하세요. Skillstore는 근거를 보고하지만 이 Skill의 안전 여부를 판단하지 않습니다.

버전별 보고서 열기

보고서 링크 복사

https://skillstore.io/skills/ctxrs-postage/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 배지

[![Skillstore security assessment](https://skillstore.io/badges/skills/ctxrs-postage/security.svg)](https://skillstore.io/skills/ctxrs-postage?utm_source=security_passport_badge)

HTML 배지

<a href="https://skillstore.io/skills/ctxrs-postage?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/ctxrs-postage/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

임베드 카드

<iframe src="https://skillstore.io/embed/skills/ctxrs-postage.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

학술 인용 (APA · BibTeX · CFF)

APA 인용

ctxrs. (2026). postage security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/ctxrs-postage/audits/1

BibTeX 인용

@techreport{ctxrs-ctxrs-postage-2026,
  author = {ctxrs},
  title = {postage security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/ctxrs-postage/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "postage security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "ctxrs"
date-released: "2026-09-18"
url: "https://skillstore.io/skills/ctxrs-postage/audits/1"
identifiers:
  - type: other
    value: "skillstore:ctxrs-postage:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore 점수

이 점수의 이유 증거 신뢰도: 중간

아키텍처

유지보수성

콘텐츠

커뮤니티

사양 준수

만들 수 있는 것

Send a Formal Dispute

Mail an authorized dispute PDF to a bank, lender, or credit bureau with a verified return address.

Mail a Cancellation Notice

Send a completed cancellation letter to a gym, subscription provider, or service company and retain its status.

Track Compliance Mail

Submit notices or forms, check delivery progress, and retrieve available receipts for an organization.

이 프롬프트를 사용해 보세요

Check a Mailing Price

Check the postage price for the PDF at [PDF_PATH] from [SENDER_ADDRESS] to [RECIPIENT_ADDRESS]. Do not send it.

Send an Authorized Letter

After I confirm the final details, send [PDF_PATH] from [SENDER_ADDRESS] to [RECIPIENT_ADDRESS] using [SERVICE]. Report the letter ID, cost, and initial status.

Use Certified Delivery

Price and prepare certified mailing for [PDF_PATH]. Show the service, total cost, addresses, and document name. Send only after my explicit confirmation.

Recover from an Uncertain Submission

Check whether letter [LETTER_ID] exists after the previous request timed out. Do not create a replacement. If no letter exists, propose a retry with the same idempotency key.

모범 사례

Verify the PDF, sender address, recipient address, service, and total cost before sending.
Use a price check when spending limits or service selection are uncertain.
Reuse the same idempotency key after timeouts and inspect existing letters before retrying.

피하기

Do not send a document when the recipient address or authorization is unclear.
Do not place API keys, full addresses, or document contents in shared prompts or logs.
Do not submit a replacement letter before checking the result of an uncertain request.