skills/wubin1836/ai-ecommerce-expert-agent-skills/ai-ecommerce-expert-ecommerce-content-studio/Gen Agent Trust Hub
ai-ecommerce-expert-ecommerce-content-studio
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/imiva_mcp.pyutilizes thesubprocess.Popenmethod to interface with the Node-based MCP package. The implementation uses a list-based argument structure rather than a shell string, effectively mitigating potential command injection risks.\n- [EXTERNAL_DOWNLOADS]: The skill fetches the official@infimind/ecom-content-clipackage from the NPM registry usingnpx. This is the standard delivery mechanism for the vendor's e-commerce content tools and is performed using a scoped package belonging to the service provider.\n- [DATA_EXPOSURE_AND_EXFILTRATION]: Authentication is managed through theMCP_TOKENenvironment variable. The skill documentation explicitly instructs users on secure secret management practices, warning against hardcoding tokens or exposing them in chat history.\n- [PROMPT_INJECTION]: The skill includes robust internal guidelines for the AI agent, such as verifying product facts against user-provided data and adhering to specific commercial guidelines, which helps maintain the integrity of the generated e-commerce content.
Audit Metadata