cn-ecommerce-ops@1.2.1
VERIFIED· install onlyPublisher claims: "国内电商全链路运营专家技能，覆盖淘宝、天猫、京东、拼多多、抖音电商、小红书、视频号、Temu八大平台。提供选品评分、定价与利润测算（含达人佣金）、广告投放ROI测算、店铺转化漏斗诊断、广告法违禁词合规检查、商品标题生成、备货与资金占用测算七个可计算工具，以及一个实时数据桥接器(live.py)——先用 WebSearch/WebFetch 拉取当前真实佣金率、类目退货率、1688进货价、关键词搜索量，再一键灌入各计算器，实现"实时可用"的决策。当用户涉及国内电商选品、定价、算利润、算ROI、投直通车或千川、做店铺诊断、写商品标题、算备货量、优化标题主图详情页、写商品文案、直播运营、检查文案是否违反广告法、Temu全托管半托管报价与合规、平台规则与流量玩法，或需要查最新费率/获取实时行情来辅助决策时，应使用本技能。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Coverage
Nothing executable in the bundle ran; the trace covers the install step only.- Tested
- every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-07 and scored it 92/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationsStatic findings
p = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.No other findings across 4,875 lines in 20 files.
Cost to the agent
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.