The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The script scripts/imiva_mcp.py executes npx -y @infimind/ecom-content-cli@latest. This command fetches and runs the latest version of the specified package from the public npm registry every time the script is invoked. This creates a risk of executing unverified or modified remote code if the package is compromised.
[COMMAND_EXECUTION]: The Python helper script scripts/imiva_mcp.py uses subprocess.Popen to execute shell commands (npx). This pattern allows the skill to interact with the system shell to bridge communication between the agent and the IMIVA MCP server.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied prompts and external materials (images/videos) which are passed to generative AI models. This represents an attack surface for indirect prompt injection.
Ingestion points: The create_video_generation_task tool accepts a prompt string and素材 (material) paths/URLs from the user context.
Boundary markers: None identified in the script logic to separate instructions from data within the prompt payload.
Capability inventory: The skill can execute shell commands, read local files (via MCP), and perform network operations through the external CLI.
Sanitization: Arguments are structured as JSON via json.dumps, ensuring structural integrity, but the content of strings is not sanitized for potential injection patterns.

ai-ecommerce-expert-seedance-2-5-ecommerce-video