The Agent Skills Directory

[COMMAND_EXECUTION]: The Python script scripts/imiva_mcp.py uses subprocess.Popen to launch the MCP (Model Context Protocol) server. This is a standard and necessary mechanism for communication between the agent and the IMIVA e-commerce content generation service using JSON-RPC.
[EXTERNAL_DOWNLOADS]: The skill utilizes npx -y @infimind/ecom-content-cli@latest to fetch and run the official e-commerce content CLI from the NPM registry. This package is owned by the service provider (Infimind) and is the primary tool for the skill's functionality.
[REMOTE_CODE_EXECUTION]: The skill dynamically executes a Node.js package (@infimind/ecom-content-cli@latest) at runtime. While this is a remote execution pattern, it targets a well-known package registry (NPM) and an official vendor-controlled package, which is standard for MCP-based skills.
[SAFE]: The skill adheres to security best practices for secret management by instructing users to provide their MCP_TOKEN via environment variables rather than hardcoding credentials within the skill files or scripts.
[SAFE]: Analysis of network operations shows that data is only transmitted to the legitimate vendor domain imiva.ecpro.com. No unauthorized data exfiltration or suspicious third-party domains were found.
[SAFE]: The skill presents an indirect prompt injection surface due to its data-processing nature, but follows mitigation standards:
Ingestion points: Untrusted user data enters via arguments like productImages, coreSellingPoints, and usageScenario in SKILL.md.
Boundary markers: The skill utilizes JSON-structured arguments which provide clear delimiters between instructions and data.
Capability inventory: Capabilities are limited to subprocess execution of the dedicated MCP tool in scripts/imiva_mcp.py.
Sanitization: Input data is JSON-serialized before transmission, preventing injection into the underlying shell or RPC transport layer.

ai-ecommerce-expert-shein-ecommerce-content