China Marketing Copilot

• Risk level: Low
• Analyzed: Apr 15, 2026, 10:02 AM
• Findings: 0
• Version: 1.3.0

Overview

This skill is internally coherent: a China 3C marketing assistant that operates on a local knowledge base and user-provided files, and it does not request unrelated credentials or install external code.

This skill appears to do what it says and does not ask for external credentials, but before installing: (1) Confirm your platform enforces the declared workspace-only restriction — the skill has read/write and bash capabilities which will operate on workspace files. (2) Do not upload any secrets (API keys, credentials) into the skill workspace; the skill will process any files you put there. (3) If you enable browser/web-search integrations to let it fetch live pages, be aware those add network scraping behavior (and may require separate credentials); review the privacy/ToS implications of scraping target platforms. (4) Review any outputs the skill will write back (used-ideas.md, knowledge base index) so you know what gets persisted. If you want extra caution, disable autonomous invocation or review logs/approvals before allowing the agent to run the skill autonomously.