ai-ecommerce-expert-new-product-launch-content

Pass

Audited by Gen Agent Trust Hub on Aug 25, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/imiva_mcp.py uses subprocess.Popen to execute the npx command. This is used to run the official IMIVA e-commerce client and is the standard way this skill interacts with the underlying tools.
  • [EXTERNAL_DOWNLOADS]: The skill uses npx -y to download and run the @infimind/ecom-content-cli package from the NPM registry at runtime. This package is the official tool provided by the vendor for the IMIVA platform.
  • [DATA_EXFILTRATION]: The skill transmits product data and an authentication token to https://imiva.ecpro.com. This communication is the primary function of the skill and targets the vendor's official domain.
  • [PROMPT_INJECTION]: The skill ingests untrusted product data (images and text) which could be used for indirect prompt injection attacks.
  • Ingestion points: Arguments passed to create_product_main_image_task and other tools via the scripts/imiva_mcp.py helper.
  • Boundary markers: None identified in the Python wrapper script; the skill relies on the agent to correctly format parameters.
  • Capability inventory: Command execution via subprocess.Popen and network access to the vendor's API.
  • Sanitization: No explicit content sanitization or validation is performed within the Python wrapper script.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 25, 2026, 08:01 AM
Security Audit — agent-trust-hub — ai-ecommerce-expert-new-product-launch-content