Cross Border Ecommerce Skill Security Audit

The primary command globally installs an unpinned repository Skill, and the document recommends several similarly unpinned add-ons. There is no evidence that commands run automatically, but if followed, installed content may exceed this audit and change with repository updates. The user can ask for pinned commits and justification for each add-on.

The questionnaire solicits revenue, AOV, margin, international-order share, team size, and whether trademarks, tax numbers, and shipping accounts exist. These are relevant to planning but together expose business scale, profitability, and compliance gaps. It does not request the actual tax-number value or state that data is transmitted externally; users can provide ranges, omit identifiers, and ask about retention.

If the user runs this command, it globally installs another Skill without a version or commit hash. The same command could therefore retrieve different content later; the user can ask for a pinned commit and a pre-install review method. It is not automatically executed.

The primary install command names a repository and uses `-g` but pins no version or commit. Running it globally installs whatever content is provided at that time, which may differ from the audited text; the user can require a verifiable pinned commit.

This is an optional follow-on Skill command and does not run by itself. If followed, however, it globally installs unpinned remote content, creating a supply-chain risk because that content can change over time.

This command is only a recommendation for an additional marketing Skill, not automatic behavior of the current Skill. If run, it still globally installs unpinned remote content. The user can restrict global installation and require a pinned commit.

This optional PPC Skill command has no version or commit identifier and uses global installation. The risk arises only if the user runs it, but the code retrieved then cannot be established from the text audited here.

This optional tariff calculator comes from another repository, with an unpinned command that installs globally. It is not installed automatically, but a fixed commit and included files should be checked before execution.

The global installation command for this optional listing Skill likewise has no pinned version or commit. The risk is conditional: content is downloaded only if the user runs it, but its future contents may change.

The process requires scores across eight dimensions and a precise weighted ranking, while the supplied country table covers only revenue, penetration, growth, and platform—not country scores or sources for the remaining factors. If the AI fills gaps, the ranking may look precise but be unverifiable and influence investment decisions. Users can require per-factor sources, assumptions, and sensitivity analysis.

The document defines IOSS as an EU import mechanism and says post-Brexit UK VAT registration is separate, yet its UK cost example says VAT is collected through an undefined “IOSS equivalent.” Treating that phrase as a filing procedure could lead to the wrong process or responsible party. Despite the verification disclaimer, users should request the exact UK mechanism and confirm it with a UK tax professional.

The prescribed output template places Nexscope branding and a promotional link directly in the user's report footer, which is unnecessary for the expansion analysis. If shared, it may imply the user endorses the service. Users can request an unbranded report; this is an output instruction, with no evidence that the link opens automatically or transmits data.