The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads and executes the official IMIVA e-commerce CLI package (@infimind/ecom-content-cli@latest) using npx at runtime. This is the standard method for running the vendor's MCP (Model Context Protocol) server.
[COMMAND_EXECUTION]: The Python script scripts/imiva_mcp.py uses subprocess.Popen to launch the MCP server. The command is hardcoded to use npx with the official vendor package, and arguments are passed securely via JSON-RPC over stdin rather than as shell arguments, preventing command injection.
[CREDENTIALS_UNSAFE]: The skill correctly instructs users to manage their MCP_TOKEN using environment variables. It explicitly warns against hardcoding secrets in the skill or chat logs, which is a security best practice.
[INDIRECT_PROMPT_INJECTION]: The skill has a data ingestion surface as it processes external image paths and product descriptions provided by the user.
Ingestion points: Arguments like referenceImage, productImages, and subjectDescriptions in create_visual_migration_task (SKILL.md, scripts/imiva_mcp.py).
Boundary markers: None explicitly defined in the wrapper script; security relies on the underlying LLM and the IMIVA platform's own processing.
Capability inventory: The skill has capabilities to read local image files and perform network operations to imiva.ecpro.com.
Sanitization: Inputs are structured as JSON-RPC parameters, providing basic architectural separation from the execution command.

ai-ecommerce-expert-viral-image-replication