ai-ecommerce-expert-ecommerce-main-image

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). 运行时通过 IMIVA MCP 工具 create_product_main_image_task 以用户提供的商品素材/卖点等参数创建任务；脚本本身只处理 JSON 入参与工具调用，没有从外部队列/网页等“读取任意外部自由文本”。

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill runs npx to fetch-and-execute the remote npm package "@infimind/ecom-content-cli@latest" at runtime (see scripts/imiva_mcp.py), which executes remote code and is required for the skill to function.