skills/wubin1836/ai-ecommerce-expert-agent-skills/ai-ecommerce-expert-new-product-launch-content/Gen Agent Trust Hub
ai-ecommerce-expert-new-product-launch-content
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/imiva_mcp.pyusessubprocess.Popento execute thenpxcommand. This is used to run the official IMIVA e-commerce client and is the standard way this skill interacts with the underlying tools. - [EXTERNAL_DOWNLOADS]: The skill uses
npx -yto download and run the@infimind/ecom-content-clipackage from the NPM registry at runtime. This package is the official tool provided by the vendor for the IMIVA platform. - [DATA_EXFILTRATION]: The skill transmits product data and an authentication token to
https://imiva.ecpro.com. This communication is the primary function of the skill and targets the vendor's official domain. - [PROMPT_INJECTION]: The skill ingests untrusted product data (images and text) which could be used for indirect prompt injection attacks.
- Ingestion points: Arguments passed to
create_product_main_image_taskand other tools via thescripts/imiva_mcp.pyhelper. - Boundary markers: None identified in the Python wrapper script; the skill relies on the agent to correctly format parameters.
- Capability inventory: Command execution via
subprocess.Popenand network access to the vendor's API. - Sanitization: No explicit content sanitization or validation is performed within the Python wrapper script.
Audit Metadata