skills/wubin1836/ai-ecommerce-expert-agent-skills/ai-ecommerce-expert-reference-image-video/Gen Agent Trust Hub
ai-ecommerce-expert-reference-image-video
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFE
Full Analysis
- [UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The skill uses
npxto download and execute the@infimind/ecom-content-clipackage. This is the official tool provided by the vendor (Beijing Infimind Technology / 极睿科技) for the IMIVA platform, representing a legitimate dependency. - [DYNAMIC_EXECUTION]: The
scripts/imiva_mcp.pyscript usessubprocess.Popento launch the MCP server. The command string is constructed from static constants rather than dynamic user input, which prevents command injection risks. - [DATA_EXPOSURE_AND_EXFILTRATION]: The skill documentation correctly advises users to manage their API tokens via environment variables (
MCP_TOKEN) instead of hardcoding them, ensuring sensitive credentials are not exposed in code or history. - [INDIRECT_PROMPT_INJECTION]: The skill processes user prompts and reference materials to generate video content. It includes instructions for fact-checking and boundary markers to ensure accuracy, which mitigates risks associated with untrusted data ingestion.
Audit Metadata