The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/imiva_mcp.py utilizes subprocess.Popen to interface with the Node-based MCP server. The implementation uses a fixed command list and avoids shell execution, which is a secure way to handle subprocesses.
[REMOTE_CODE_EXECUTION]: The skill is configured to download the @infimind/ecom-content-cli package at runtime using npx. This is the official distribution method for the IMIVA toolset and uses a scoped package to verify the publisher's identity.
[CREDENTIALS_UNSAFE]: Access to the service is managed through an MCP_TOKEN. The skill documentation correctly identifies this as sensitive information and provides best-practice guidance for storing it in environment variables rather than hardcoding it.
[PROMPT_INJECTION]: The skill ingests user input and external material links to define video generation tasks. This presents a surface for indirect prompt injection, though the impact is limited to the specific video generation context and managed by the service provider's safety filters.

ai-ecommerce-expert-ecommerce-text-to-video