ai-ecommerce-expert-local-product-image-edit

Pass

Audited by Gen Agent Trust Hub on Aug 25, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill includes a Python script scripts/imiva_mcp.py that executes the npx command via subprocess.Popen. This is used to launch the official IMIVA Ecommerce MCP client to perform image editing tasks. The script uses a list-based argument format and handles communication through standard input/output, which is a secure method for process interaction.\n- [EXTERNAL_DOWNLOADS]: The script dynamically invokes the Node.js package @infimind/ecom-content-cli@latest using npx. This package is the official tool provided by the vendor for interacting with their API. The use of the @latest tag ensures the most recent features are used, which is consistent with the skill's purpose as a bridge to a cloud-based eCommerce service.\n- [PROMPT_INJECTION]: The skill ingests user-supplied image paths and descriptive prompts to generate editing tasks. Ingestion points: User requirements are captured via CLI arguments in SKILL.md. Boundary markers: The instructions guide the agent to structure these into specific JSON parameters, though explicit delimiters for raw user text are not enforced in the script. Capability inventory: The script uses subprocess.Popen to call the external MCP tool create_smart_refine_task. Sanitization: The Python script uses json.dumps() to safely serialize all parameters before transmission, preventing injection into the underlying communication protocol.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 25, 2026, 08:01 AM
Security Audit — agent-trust-hub — ai-ecommerce-expert-local-product-image-edit