The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill utilizes npx to dynamically fetch and execute the @infimind/ecom-content-cli package. This is an official package associated with the vendor (Infimind) and is used for its intended e-commerce content generation purpose.
[COMMAND_EXECUTION]: The helper script scripts/imiva_mcp.py uses subprocess.Popen to bridge communication between the agent and the Node.js-based MCP client. The command is restricted to the specific npm package and does not use a shell (shell=False is implied by list arguments), which reduces the risk of command injection.
[CREDENTIALS_SAFE]: The instructions and configuration examples correctly emphasize that sensitive API tokens (MCP_TOKEN) should be stored in environment variables or a local configuration file, not in the skill's source code or shared logs.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: Product names, categories, and selling points are ingested via the create_koc_collage_task tool.
Boundary markers: The skill uses structured JSON objects to pass arguments to the MCP bridge script, providing clear data boundaries.
Capability inventory: The skill has the ability to execute the specific Infimind MCP CLI and perform file system reads for material paths.
Sanitization: Inputs are serialized into JSON in imiva_mcp.py before being passed to the subprocess, preventing simple injection attacks against the command-line interface.

ai-ecommerce-expert-koc-seeding-collage