ai-ecommerce-expert-first-last-frame-video

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). IMIVA MCP 调用链路通过脚本 scripts/imiva_mcp.py 的 invoke()/tools/call 将运行时用户在 create_video_generation_task 的 prompt 等字段（以及 referenceImages 的 HTTPS URL 或本地路径对应的素材）作为可读自由文本/输入参数直接传入 MCP 服务生成任务。

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill's runtime script scripts/imiva_mcp.py invokes npx to run the external npm package "@infimind/ecom-content-cli@latest" (also referenced in SKILL.md and references/mcp-config.example.json), which causes remote code to be fetched and executed at runtime and is required for the skill to function.