ai-ecommerce-expert-campaign-kv-style-migration

Pass

Audited by Gen Agent Trust Hub on Aug 25, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The helper script scripts/imiva_mcp.py uses subprocess.Popen to invoke the npx command. This is the primary mechanism used to interact with the IMIVA platform's tools.- [REMOTE_CODE_EXECUTION]: The skill executes remote code by using npx -y to run the @infimind/ecom-content-cli package. This allows the skill to utilize the vendor's official toolset via a remote registry.- [EXTERNAL_DOWNLOADS]: The skill downloads the @infimind/ecom-content-cli package from the NPM registry during execution. This dependency is necessary for the skill to communicate with the IMIVA platform.- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user data (product images and descriptions) which are passed as arguments to the external tool.
  • Ingestion points: productImages and subjectDescriptions in SKILL.md.
  • Boundary markers: Input data is encapsulated within a JSON-RPC structure before being passed to the tool.
  • Capability inventory: The skill can trigger automated image and video generation tasks on the vendor's platform.
  • Sanitization: No specific filtering is applied to the descriptions beyond standard JSON encoding.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 25, 2026, 08:01 AM
Security Audit — agent-trust-hub — ai-ecommerce-expert-campaign-kv-style-migration