The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/imiva_mcp.py uses subprocess.Popen to interface with the MCP server. The execution is restricted to the specific vendor package using a hardcoded argument list, which prevents shell injection.
[EXTERNAL_DOWNLOADS]: The skill uses npx to dynamically fetch and execute the @infimind/ecom-content-cli package. This is the intended delivery mechanism for the IMIVA MCP tools and targets a package associated with the vendor (Infimind / 极睿科技).
[DATA_EXPOSURE]: The skill requires an authentication token (MCP_TOKEN). The instructions correctly advise users to manage this secret via environment variables and explicitly warn against hardcoding it in files or sharing it in chat history.
[REMOTE_CODE_EXECUTION]: The skill executes external code via the NPM registry using npx. This behavior is transparently documented and serves the primary purpose of the skill to provide access to the vendor's automation tools.

ai-ecommerce-expert-mcp-ecommerce-automation