ai-ecommerce-expert-batch-sku-content-production

Pass

Audited by Gen Agent Trust Hub on Aug 25, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/imiva_mcp.py utilizes subprocess.Popen to establish a communication bridge with the MCP server. This is a functional requirement for translating agent instructions into API calls for the IMIVA platform.
  • [EXTERNAL_DOWNLOADS]: The skill downloads the official @infimind/ecom-content-cli package from the npm registry using npx. This ensures the environment uses the latest version of the vendor's integration tools.
  • [DATA_EXPOSURE]: The skill correctly handles sensitive authentication by requiring the MCP_TOKEN to be provided via a local environment variable, following security best practices for credential management in automated workflows.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied product descriptions and image paths. While this presents an ingestion surface for potential instructions, the skill includes explicit guidelines to verify product facts and adhere to specific content goals, which serves as a mitigation layer.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 25, 2026, 08:01 AM
Security Audit — agent-trust-hub — ai-ecommerce-expert-batch-sku-content-production