The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses npx to fetch the @infimind/ecom-content-cli package from npm at runtime. The use of the @latest tag means the skill always downloads the most recent version, which could introduce unverified code if the package is compromised.
[REMOTE_CODE_EXECUTION]: The downloaded npm package is executed locally to provide the core ecommerce functionality.
[COMMAND_EXECUTION]: The helper script scripts/imiva_mcp.py uses subprocess.Popen to launch the Node.js process and the IMIVA CLI, handling communication via standard input and output.
[DATA_EXFILTRATION]: The skill transmits product information and authentication tokens to the IMIVA service domain (imiva.ecpro.com) to perform its intended e-commerce tasks. This involves network communication to a domain outside the default whitelisted services.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests untrusted product descriptions and image paths. Ingestion points: productImages and extraDescription arguments in create_detail_page_task. Boundary markers: None provided to the model context. Capability inventory: File system access for image paths and network access via the IMIVA API. Sanitization: Arguments are passed via JSON encoding, providing structural but not semantic validation.

ai-ecommerce-expert-long-detail-page-set