ai-ecommerce-expert-vertical-9-16-short-video

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). 该 Skill 的运行时工作流通过 IMIVA 的 MCP 工具 create_video_generation_task 接收用户在 prompt/素材参数中提供的免费文本并提交给工具执行（见脚本把 --args JSON 直接作为 tools/call 的 arguments 传入）。

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill invokes npx to run the remote npm package "@infimind/ecom-content-cli@latest" at runtime (scripts/imiva_mcp.py), which will fetch and execute remote code and is required for MCP operations.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly integrates IMIVA MCP payment-related APIs: it names the MCP tool create_video_generation_task as the primary tool and shows workflows that query get_user_credits, run a dryRun to obtain estimatedCredits, then create tasks with a maxCredits limit (i.e. submitting billable jobs that consume/charge credits). Those calls are specific to executing paid operations on the platform (creating paid orders/consuming credits), which constitutes direct financial execution authority.