skills/wubin1836/ai-ecommerce-expert-agent-skills/ai-ecommerce-expert-ecommerce-main-image/Gen Agent Trust Hub
ai-ecommerce-expert-ecommerce-main-image
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npxto download and execute the package@infimind/ecom-content-cli@latestfrom the npm registry. This is the official client for the IMIVA platform as described in the documentation. - [COMMAND_EXECUTION]: The script
scripts/imiva_mcp.pyusessubprocess.Popento launch the Node.js package manager (npx) to facilitate communication with the remote tool. The execution path is hardcoded to the specific vendor package and does not allow for arbitrary shell injection. - [DATA_EXFILTRATION]: The skill transmits user-provided product data (such as image paths, categories, and selling points) to
imiva.ecpro.com. This is necessary for the stated purpose of the skill (generating images using the vendor's cloud service). - [INDIRECT_PROMPT_INJECTION]: The skill accepts unstructured user input for product descriptions and marketing copy. While this provides a surface for potential injection, the data is handled via structured JSON-RPC calls to a specific tool, limiting the risk of affecting the primary agent's instructions.
Audit Metadata