ai-ecommerce-expert-jd-ecommerce-content

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill invokes npx to fetch and run the npm package "@infimind/ecom-content-cli@latest" at runtime (see scripts/imiva_mcp.py), which causes remote code to be downloaded and executed rather than just calling a stable HTTP API.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill exposes explicit MCP APIs that query and consume user "credits" and can create billable tasks. Examples: it documents a get_user_credits call, instructs using a dryRun to obtain estimatedCredits before creating paid video/image tasks, shows create_product_main_image_task which may deduct credits, and requires setting a maxCredits limit and discusses recharging the account. These are specific, non-generic financial actions (query balance, set spending cap, and submit transactions that bill the account), so the skill grants direct financial execution authority over platform credits.