skills/wubin1836/ai-ecommerce-expert-agent-skills/ai-ecommerce-expert-scene-product-main-image/Gen Agent Trust Hub
ai-ecommerce-expert-scene-product-main-image
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONCREDENTIALS_UNSAFEPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes the
npxcommand to download and execute the@infimind/ecom-content-clipackage from the official NPM registry. This package is the official tool for the IMIVA e-commerce platform described in the skill metadata. - [COMMAND_EXECUTION]: The Python script
scripts/imiva_mcp.pyusessubprocess.Popento execute the downloaded MCP tool. This allows the agent to perform actions such as creating image generation tasks and checking user credits via the command line. - [CREDENTIALS_UNSAFE]: The skill follows security best practices by instructing users to store their authentication tokens in the
MCP_TOKENenvironment variable rather than hardcoding them into the skill scripts or configuration files. - [PROMPT_INJECTION]: The skill accepts user-provided content (product categories, selling points, and usage scenarios) which are interpolated into tool arguments. While this represents a surface for indirect prompt injection, the risk is mitigated by the structured nature of the data passed to the IMIVA API.
Audit Metadata