The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/imiva_mcp.py uses subprocess.Popen to execute the npx command. This is used to run the @infimind/ecom-content-cli package, which is the core functional mechanism for this skill. The script correctly uses argument lists rather than shell strings to mitigate command injection risks.- [EXTERNAL_DOWNLOADS]: The skill uses npx to download and execute the @infimind/ecom-content-cli@latest package from the NPM registry. This package is owned by the vendor (Infimind) and is required for the skill to communicate with the IMIVA ecommerce content service.- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided product data, including categories, selling points, and usage scenarios, which are then passed to the generating model. This represents a potential surface for indirect prompt injection if malicious instructions are embedded in product descriptions.
Ingestion points: create_product_main_image_task parameters such as coreSellingPoints and usageScenario in SKILL.md.
Boundary markers: Absent. The skill does not define specific delimiters to wrap untrusted user content.
Capability inventory: The skill can execute shell commands via subprocess.Popen and perform network requests via the vendor CLI to the IMIVA API.
Sanitization: Not explicitly implemented in the bridge script; relies on the agent's internal safety filters and the downstream API's validation.

ai-ecommerce-expert-shoes-bags-ecommerce-content