The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill utilizes the @infimind/ecom-content-cli package, which is fetched from the npm registry using npx. This is the official tool provided by the vendor (Infimind) for interacting with the IMIVA platform.
[COMMAND_EXECUTION]: The helper script scripts/imiva_mcp.py uses subprocess.Popen to execute the npx command. This is used to bridge the Python environment to the Node.js MCP client. The execution is restricted to the specific vendor package and uses structured JSON-RPC for communication, minimizing risks associated with shell interpolation.
[CREDENTIALS_SAFE]: The skill requires an API token (MCP_TOKEN) for authentication with the IMIVA service. The documentation explicitly instructs users to provide this via environment variables and warns against hardcoding it or sharing it in logs or repositories, adhering to secure secret management practices.
[INDIRECT_PROMPT_INJECTION]: The skill acts as a bridge for user-provided product data (categories, selling points, image paths) to the IMIVA API. While it ingests external data, it processes this into structured JSON parameters for an external generation service, which serves as a natural boundary against prompt injection attacks targeting the local agent.

ai-ecommerce-expert-reference-style-main-image