skills/wubin1836/ai-ecommerce-expert-agent-skills/ai-ecommerce-expert-local-product-image-edit/Gen Agent Trust Hub
ai-ecommerce-expert-local-product-image-edit
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a Python script
scripts/imiva_mcp.pythat executes thenpxcommand viasubprocess.Popen. This is used to launch the official IMIVA Ecommerce MCP client to perform image editing tasks. The script uses a list-based argument format and handles communication through standard input/output, which is a secure method for process interaction.\n- [EXTERNAL_DOWNLOADS]: The script dynamically invokes the Node.js package@infimind/ecom-content-cli@latestusingnpx. This package is the official tool provided by the vendor for interacting with their API. The use of the@latesttag ensures the most recent features are used, which is consistent with the skill's purpose as a bridge to a cloud-based eCommerce service.\n- [PROMPT_INJECTION]: The skill ingests user-supplied image paths and descriptive prompts to generate editing tasks. Ingestion points: User requirements are captured via CLI arguments inSKILL.md. Boundary markers: The instructions guide the agent to structure these into specific JSON parameters, though explicit delimiters for raw user text are not enforced in the script. Capability inventory: The script usessubprocess.Popento call the external MCP toolcreate_smart_refine_task. Sanitization: The Python script usesjson.dumps()to safely serialize all parameters before transmission, preventing injection into the underlying communication protocol.
Audit Metadata