The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill dynamically downloads the @infimind/ecom-content-cli package from the npm registry using npx -y at runtime. The use of the @latest tag creates a dependency on the external registry's current state and could lead to unexpected behavior if the package is updated.
[COMMAND_EXECUTION]: The script scripts/imiva_mcp.py utilizes subprocess.Popen to execute shell commands (npx). While the command is scoped to the specific IMIVA package, it represents a bridge between the AI environment and the host system's shell.
[REMOTE_CODE_EXECUTION]: By invoking npx, the skill executes code retrieved from a remote source. This is the intended delivery mechanism for the tool but constitutes remote code execution as part of the skill's operation.
[DATA_EXPOSURE]: The skill is designed to handle local file paths for product images (referenceImages). While this is a core feature, it grants the agent visibility into the local filesystem for specific files passed to the tool.
[INDIRECT_PROMPT_INJECTION]: As the skill processes external product data and user descriptions to generate video parameters, it possesses an attack surface for indirect prompt injection. The skill includes instructions for the agent to verify facts and goals as a mitigation strategy.

ai-ecommerce-expert-product-image-to-video