ai-ecommerce-expert-product-image-to-video

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Skill 的运行时工作流通过调用脚本 scripts/imiva_mcp.py 启动 @infimind/ecom-content-cli@latest，并把用户输入的 prompt、referenceImages（含 HTTPS URL）等参数直接作为 MCP create_video_generation_task 的请求内容发送给模型/服务；该工作流并不主动从外部抓取任意网页正文，但会读取用户提供的自由文本（prompt）与用户提供的素材引用信息。

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill invokes npx to run the npm package "@infimind/ecom-content-cli@latest" at runtime (see PACKAGE = "@infimind/ecom-content-cli@latest"), which fetches and executes remote code that the skill relies on.