ai-ecommerce-expert-ecommerce-text-to-video

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The code runs a remotely fetched npm package via npx while passing a sensitive MCP_TOKEN from the environment into that process (and ships examples showing the token in configs), creating a high-risk supply-chain and potential credential-exfiltration vector.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). 运行时工作流通过调用 IMIVA 的 MCP 工具（如 create_video_generation_task）直接接收用户在 prompt 等字段提供的自由文本并发送到 MCP，因此该自由文本会被 LLM/工具链摄取而非先选择受信条目。

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill invokes npx to fetch and execute the remote npm package "@infimind/ecom-content-cli@latest" at runtime (e.g., via scripts/imiva_mcp.py), which downloads and runs external code the skill depends on.