ai-ecommerce-expert-ecommerce-content-studio

Pass

Audited by Gen Agent Trust Hub on Aug 25, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/imiva_mcp.py utilizes the subprocess.Popen method to interface with the Node-based MCP package. The implementation uses a list-based argument structure rather than a shell string, effectively mitigating potential command injection risks.\n- [EXTERNAL_DOWNLOADS]: The skill fetches the official @infimind/ecom-content-cli package from the NPM registry using npx. This is the standard delivery mechanism for the vendor's e-commerce content tools and is performed using a scoped package belonging to the service provider.\n- [DATA_EXPOSURE_AND_EXFILTRATION]: Authentication is managed through the MCP_TOKEN environment variable. The skill documentation explicitly instructs users on secure secret management practices, warning against hardcoding tokens or exposing them in chat history.\n- [PROMPT_INJECTION]: The skill includes robust internal guidelines for the AI agent, such as verifying product facts against user-provided data and adhering to specific commercial guidelines, which helps maintain the integrity of the generated e-commerce content.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 25, 2026, 08:01 AM
Security Audit — agent-trust-hub — ai-ecommerce-expert-ecommerce-content-studio