skills/wubin1836/ai-ecommerce-expert-agent-skills/ai-ecommerce-expert-gpt-image-2-ecommerce-image/Gen Agent Trust Hub
ai-ecommerce-expert-gpt-image-2-ecommerce-image
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The script
scripts/imiva_mcp.pyusesnpx -yto download and execute the@infimind/ecom-content-cli@latestpackage from the npm registry. This is the official package for the IMIVA platform (Infimind) described in the skill, and is the intended mechanism for accessing its tools. - [COMMAND_EXECUTION]: The Python helper script uses
subprocess.Popento launch the Node.js client. This is a standard integration pattern for multi-language skills to facilitate communication between the agent and the MCP server. - [CREDENTIALS_SAFE]: The skill correctly handles authentication by requiring users to set an
MCP_TOKENenvironment variable, ensuring that sensitive credentials are not hardcoded or exposed in the skill configuration. - [INDIRECT_PROMPT_INJECTION]: The skill accepts user-provided image paths and descriptive prompts for image editing. While this represents a potential attack surface for indirect prompt injection, the skill includes clear instructions for the agent to verify facts, adhere to provided brand guidelines, and confirm credit usage before task execution, which serves as a functional safeguard.
Audit Metadata