The Agent Skills Directory

[COMMAND_EXECUTION]: The Python script scripts/imiva_mcp.py uses subprocess.Popen to launch the Node.js environment via npx. The command string is hardcoded to execute the specific vendor package, and user-provided arguments are passed through standard input using JSON-RPC, which prevents shell injection vulnerabilities.
[EXTERNAL_DOWNLOADS]: The skill fetches the official vendor package @infimind/ecom-content-cli from the NPM registry at runtime. This package is managed by the platform provider (Beijing Infimind Technology) to facilitate communication with the IMIVA ecommerce API.
[CREDENTIALS_SAFE]: The documentation correctly directs users to store their MCP_TOKEN in environment variables rather than hardcoding it in configuration files or code, adhering to standard security practices for API key management.
[INDIRECT_PROMPT_INJECTION]: The skill provides an interface for the agent to process user-supplied product information and images. While the data is passed to an external API, the risk of indirect injection is mitigated by the structured JSON-RPC communication and the platform's internal content safety filters.

ai-ecommerce-expert-lifestyle-seeding-image