The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill utilizes npx to download and execute the @infimind/ecom-content-cli package from the official NPM registry at runtime. This package is the legitimate client provided by the vendor for interacting with their e-commerce content API.- [COMMAND_EXECUTION]: The helper script scripts/imiva_mcp.py uses subprocess.Popen to launch the MCP client. The implementation is secure as it uses a fixed list of arguments rather than a single string, which prevents shell injection vulnerabilities during tool invocation.- [CREDENTIALS_UNSAFE]: The skill handles authentication by reading the MCP_TOKEN from environment variables. The accompanying documentation correctly instructs users on how to manage these secrets securely, advising against hardcoding tokens in the skill or code.- [PROMPT_INJECTION]: The skill processes user-supplied text prompts for video generation via the create_video_generation_task tool. Ingestion occurs in scripts/imiva_mcp.py where data is passed to the video generation API. Although no explicit boundary markers or sanitization are present, the threat is minimal because the downstream process is restricted to generating multimedia content and does not expose system-level command capabilities.

ai-ecommerce-expert-product-unboxing-video