skills/wubin1836/ai-ecommerce-expert-agent-skills/ai-ecommerce-expert-viral-sales-video/Gen Agent Trust Hub
ai-ecommerce-expert-viral-sales-video
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill uses
npx -y @infimind/ecom-content-cli@latestto dynamically download and execute the official IMIVA Ecommerce MCP tool. This is the intended operation for accessing the service's features. - [DYNAMIC_EXECUTION]: The
scripts/imiva_mcp.pyfile usessubprocess.Popento launch the MCP CLI. The command is constructed using a fixed package name and parameters passed via standard input, minimizing injection risks. - [DATA_EXPOSURE]: The skill provides instructions for managing authentication tokens via environment variables (
MCP_TOKEN), which is a secure practice compared to hardcoding credentials. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied assets such as
referenceVideoandproductImages. * Ingestion points: Local file paths or HTTPS URLs provided as arguments to the tool. * Boundary markers: The skill instructions lack explicit delimiters for external content, but the data is passed to a structured API. * Capability inventory: Subprocess execution is limited to the official vendor CLI. * Sanitization: Parameters are serialized to JSON before being passed to the tool.
Audit Metadata