skills/wubin1836/ai-ecommerce-expert-agent-skills/ai-ecommerce-expert-competitor-composition-rebuild/Gen Agent Trust Hub
ai-ecommerce-expert-competitor-composition-rebuild
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill dynamically fetches and executes the official Node.js client package '@infimind/ecom-content-cli@latest' via npx. This package is the authoritative tool for the IMIVA platform described in the skill documentation.
- [COMMAND_EXECUTION]: The helper script 'scripts/imiva_mcp.py' manages the communication with the MCP server using subprocess.Popen. The execution is restricted to the specific vendor package, which follows standard integration patterns for this type of agent skill.
- [CREDENTIALS_UNSAFE]: The skill requires a platform access token (MCP_TOKEN). It follows security best practices by instructing the user to provide this via environment variables or a local configuration file, avoiding hardcoded secrets within the skill itself.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided product descriptions and image metadata to formulate generation tasks. This creates a surface for indirect prompt injection; however, the impact is constrained to the visual generation context and is managed by the underlying platform's safeguards.
Audit Metadata