ai-ecommerce-expert-selling-point-product-image

Pass

Audited by Gen Agent Trust Hub on Aug 25, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses a Python script scripts/imiva_mcp.py that executes the official @infimind/ecom-content-cli package via npx. This is the intended purpose of the skill to communicate with the IMIVA ecommerce service. The subprocess.Popen call uses a static list of arguments and does not use shell=True, which follows security best practices for command execution.
  • [EXTERNAL_DOWNLOADS]: The skill downloads the official IMIVA MCP client from the NPM registry using npx -y @infimind/ecom-content-cli@latest. This is a standard procedure for accessing current MCP tools from a known service provider.
  • [DATA_EXPOSURE]: The skill requires an MCP_TOKEN for authentication. It correctly instructs users to provide this via environment variables or secure configuration rather than hardcoding it into the skill files, which is the correct way to handle sensitive credentials.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 25, 2026, 08:02 AM
Security Audit — agent-trust-hub — ai-ecommerce-expert-selling-point-product-image