skills/wubin1836/ai-ecommerce-expert-agent-skills/ai-ecommerce-expert-vertical-9-16-short-video/Gen Agent Trust Hub
ai-ecommerce-expert-vertical-9-16-short-video
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill downloads and executes the
@infimind/ecom-content-cli@latestpackage from the NPM registry at runtime using thenpxcommand. While this is the official tool for the IMIVA platform, executing unpinned remote code is a common surface for supply chain risks. - [COMMAND_EXECUTION]: The helper script
scripts/imiva_mcp.pyusessubprocess.Popento call shell commands. This is used to wrap the Node.js-based Model Context Protocol (MCP) tool and facilitate interaction with the agent environment. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied product information which is interpolated into prompts for video generation.
- Ingestion points: Product names, selling points, target audience, and descriptions provided via the
create_video_generation_tasktool. - Boundary markers: Absent. User-provided data is not delimited from system instructions.
- Capability inventory: The skill can trigger remote video generation tasks and budget deductions on the IMIVA platform.
- Sanitization: No filtering or escaping is applied to user-provided strings before they are used in the generated prompt.
Audit Metadata