The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/imiva_mcp.py uses subprocess.Popen to execute shell commands via npx. This is used to bridge the Python agent environment with the Node.js-based @infimind/ecom-content-cli package. The command is restricted to the specific vendor package and is used for intended functionality.
[EXTERNAL_DOWNLOADS]: The skill downloads and executes the @infimind/ecom-content-cli package from the NPM registry at runtime using npx -y. This dependency is consistent with the skill's purpose as an interface for the IMIVA (Infimind) ecommerce platform.
[DATA_EXPOSURE]: The skill requires an MCP_TOKEN for authentication. The instructions follow security best practices by advising users to store the token in environment variables rather than hardcoding it within the skill or configuration files.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it processes external image paths and user-provided descriptions (objectDescription). However, these inputs are used as parameters for the image processing API rather than being executed as instructions. The potential risk is low and inherent to tools processing external content.

ai-ecommerce-expert-batch-sku-color-unification