skills/wubin1836/ai-ecommerce-expert-agent-skills/ai-ecommerce-expert-reference-detail-page/Gen Agent Trust Hub
ai-ecommerce-expert-reference-detail-page
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npxto fetch and execute the@infimind/ecom-content-clipackage at runtime. This is the official utility for the IMIVA platform described in the skill documentation. - [COMMAND_EXECUTION]: The script
scripts/imiva_mcp.pyusessubprocess.Popento launch the external MCP client tool. This is a standard implementation for bridging the agent with specialized Node.js tools. - [PROMPT_INJECTION]: The skill ingests user-supplied product information and images, creating a surface for indirect prompt injection via the e-commerce generation workflow. 1. Ingestion points: Input parameters such as
productImagesandextraDescriptionare passed to thecreate_detail_page_tasktool inSKILL.md. 2. Boundary markers: No specific delimiters or safety instructions are implemented within the skill to isolate user-provided data from system instructions. 3. Capability inventory: The skill initiates detail page generation tasks and retrieves results from the remote IMIVA platform viascripts/imiva_mcp.py. 4. Sanitization: While inputs are structured in JSON, no semantic validation or filtering of user-provided text is performed locally before transmission.
Audit Metadata