ai-ecommerce-expert-reference-detail-page

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). 脚本 scripts/imiva_mcp.py 在调用 IMIVA MCP（如 tools/call 的 create_detail_page_task）时只把用户提供的 JSON 参数（例如 extraDescription、图片/视频路径/URL）作为工具入参发送给 MCP，并未展示对“外部第三方/任意投稿文本”的被动读取或队列/订阅式监控。

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill invokes npx to fetch and execute the npm package "@infimind/ecom-content-cli@latest" at runtime (see scripts/imiva_mcp.py), which downloads and runs remote code and is required for the MCP calls.