The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/imiva_mcp.py uses subprocess.Popen to launch the npx command. This is used to bridge the Python environment to the Node-based MCP client. The command is executed using a list of arguments, which prevents shell injection, and data is transmitted to the subprocess via stdin.
[EXTERNAL_DOWNLOADS]: The skill uses npx -y @infimind/ecom-content-cli@latest to fetch and run the latest version of the IMIVA Ecommerce MCP package from the NPM registry at runtime. This allows the skill to stay updated but introduces a dependency on external hosting services.
[REMOTE_CODE_EXECUTION]: The execution of the remotely-fetched @infimind/ecom-content-cli package occurs whenever a tool is invoked. While this is the official client for the service, it represents the execution of third-party code that is not bundled with the skill.
[PROMPT_INJECTION]: The skill processes untrusted product data, such as category names, selling points, and usage scenarios, which are interpolated into requests sent to the ecommerce AI models.
Ingestion points: Input parameters for create_product_main_image_task, create_detail_page_task, and create_video_generation_task within SKILL.md and scripts/imiva_mcp.py.
Boundary markers: None. The skill transmits raw text descriptions directly to the underlying MCP tools without specialized delimiters or instructions to ignore embedded commands.
Capability inventory: The skill can perform network operations via the IMIVA API and execute shell commands through the npx bridge to process content.
Sanitization: Arguments are serialized into a JSON payload, which provides basic structural escaping, but the content itself is not sanitized for potential indirect injection attacks.

ai-ecommerce-expert-temu-ecommerce-content