The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The script scripts/imiva_mcp.py executes the command npx -y @infimind/ecom-content-cli@latest. This pattern downloads the package from the public NPM registry and executes it immediately upon invocation, introducing a dependency on external code that is not pinned to a specific version.
[DYNAMIC_EXECUTION]: The Python helper script scripts/imiva_mcp.py uses subprocess.Popen to launch and communicate with the external Node.js process. This enables the skill to execute shell commands at runtime to bridge to the MCP server.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user data through fields like sellingPoints and targetAudience which are subsequently passed to external AI models.
Ingestion points: User-provided arguments for the create_image_expand_task tool, processed by the load_args function in scripts/imiva_mcp.py.
Boundary markers: Absent. The skill instructions do not specify the use of delimiters or warnings to ignore embedded instructions in the user data.
Capability inventory: The skill has the capability to execute shell commands (subprocess.Popen) and perform network operations via the underlying MCP tool.
Sanitization: Absent. The script utilizes standard JSON serialization but lacks semantic filtering or sanitization of the input text against potential injection patterns.

ai-ecommerce-expert-product-image-expansion