skills/wubin1836/ai-ecommerce-expert-agent-skills/ai-ecommerce-expert-product-demo-video/Gen Agent Trust Hub
ai-ecommerce-expert-product-demo-video
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The helper script
scripts/imiva_mcp.pyutilizessubprocess.Popento launch the Model Context Protocol (MCP) server. The command is executed using a list-based argument structure[npx, "-y", "@infimind/ecom-content-cli@latest"]with a hardcoded package name, which prevents shell injection vulnerabilities. - [EXTERNAL_DOWNLOADS]: The skill dynamically fetches and executes the
@infimind/ecom-content-clipackage from the official NPM registry usingnpxat runtime. This package is the designated client for the IMIVA e-commerce platform utilized by this skill. - [CREDENTIALS_SAFE]: The documentation and code correctly advise against hardcoding sensitive information. It instructs users to provide the
MCP_TOKENvia environment variables, ensuring that authentication secrets are handled outside of the skill's source code. - [REMOTE_CODE_EXECUTION]: While the skill executes remote code by downloading a Node.js package, this code is limited to the official vendor resource required for the skill's primary functionality (e-commerce video production).
Audit Metadata