skills/wubin1836/ai-ecommerce-expert-agent-skills/ai-ecommerce-expert-instagram-ecommerce-content/Gen Agent Trust Hub
ai-ecommerce-expert-instagram-ecommerce-content
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the execution of the
@infimind/ecom-content-clipackage from the official NPM registry vianpx. This is a vendor-managed resource provided by Beijing Jiruikeji to facilitate e-commerce content production. - [COMMAND_EXECUTION]: The Python script
scripts/imiva_mcp.pyusessubprocess.Popento launch thenpxcommand. This is the intended mechanism for the agent to interact with the Model Context Protocol (MCP) server provided by the vendor. - [DATA_EXPOSURE]: The skill uses an
MCP_TOKENfor authentication. The instructions correctly advise users to store this sensitive token in local environment variables rather than hardcoding it, aligning with standard secret management practices. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied text such as product selling points and target audience descriptions to generate marketing copy.
- Ingestion points: Data enters the system through tool arguments like
sellingPointsandproductNameinSKILL.mdand the Python script. - Boundary markers: Data is encapsulated within JSON-RPC payloads before being passed to the CLI tool.
- Capability inventory: The skill uses subprocess execution and network requests (via the vendor CLI) to interact with the IMIVA API.
- Sanitization: Input validation is deferred to the vendor's API and the CLI tool's argument parsing.
Audit Metadata