skills/wubin1836/ai-ecommerce-expert-agent-skills/ai-ecommerce-expert-campaign-kv-style-migration/Gen Agent Trust Hub
ai-ecommerce-expert-campaign-kv-style-migration
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The helper script
scripts/imiva_mcp.pyusessubprocess.Popento invoke thenpxcommand. This is the primary mechanism used to interact with the IMIVA platform's tools.- [REMOTE_CODE_EXECUTION]: The skill executes remote code by usingnpx -yto run the@infimind/ecom-content-clipackage. This allows the skill to utilize the vendor's official toolset via a remote registry.- [EXTERNAL_DOWNLOADS]: The skill downloads the@infimind/ecom-content-clipackage from the NPM registry during execution. This dependency is necessary for the skill to communicate with the IMIVA platform.- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user data (product images and descriptions) which are passed as arguments to the external tool. - Ingestion points:
productImagesandsubjectDescriptionsinSKILL.md. - Boundary markers: Input data is encapsulated within a JSON-RPC structure before being passed to the tool.
- Capability inventory: The skill can trigger automated image and video generation tasks on the vendor's platform.
- Sanitization: No specific filtering is applied to the descriptions beyond standard JSON encoding.
Audit Metadata