skills/wubin1836/ai-ecommerce-expert-agent-skills/ai-ecommerce-expert-nano-banana-pro-ecommerce-image/Gen Agent Trust Hub
ai-ecommerce-expert-nano-banana-pro-ecommerce-image
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes
npxto download and run the official@infimind/ecom-content-clipackage from the NPM registry at runtime. This is the intended delivery method for the platform's tools. - [COMMAND_EXECUTION]: The helper script
scripts/imiva_mcp.pyexecutes thenpxcommand usingsubprocess.Popen. It uses an argument list format which avoids shell-based command injection. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided descriptions and image paths. This is a necessary part of the e-commerce generation workflow and is documented as a standard capability. 1. Ingestion points:
promptandimagesarguments inscripts/imiva_mcp.py. 2. Boundary markers: None explicitly implemented in code, but instructions for product fact verification are provided inSKILL.md. 3. Capability inventory: Subprocess execution of the platform CLI tools. 4. Sanitization: Arguments are validated as valid JSON structures before being passed to the tool.
Audit Metadata