The Agent Skills Directory

[COMMAND_EXECUTION]: The helper script scripts/imiva_mcp.py uses subprocess.Popen to execute the npx command. This is used to run the IMIVA MCP client. The implementation is secure as it uses a fixed list for arguments and does not invoke a shell (shell=True is absent). User-provided arguments for the MCP tools are passed safely via standard input (JSON-RPC) rather than through command-line shell interpolation.
[EXTERNAL_DOWNLOADS]: The skill uses npx to dynamically download and execute the @infimind/ecom-content-cli@latest package from the NPM registry. This package is the official tool for the vendor's service as described in the skill's documentation. While this introduces a dependency on the NPM registry, it is a standard deployment method for MCP-based tools and traces back to the vendor's infrastructure.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-provided product materials and descriptions to generate video content, creating a potential surface for indirect prompt injection.
Ingestion points: User-supplied material paths and text prompts passed through the create_video_generation_task tool in scripts/imiva_mcp.py.
Boundary markers: The skill lacks explicit boundary markers or 'ignore' instructions for the data sent to the backend video model.
Capability inventory: The skill can execute local CLI commands via the imiva_mcp.py wrapper script and perform network operations via the NPM package.
Sanitization: The script performs JSON structure validation but does not sanitize the content of the strings passed to the remote generation task.

ai-ecommerce-expert-batch-video-variations