ai-ecommerce-expert-viral-video-high-fidelity

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). IMIVA Ecommerce MCP 调用路径在 scripts/imiva_mcp.py 中会把用户提供的 tool 参数（通过 --args/--args-file 作为 JSON 字段）原样传给 @infimind/ecom-content-cli 的 create_viral_video_copy_task/get_user_tasks 等方法，从而让外部用户的自由文本进入 LLM 生成链路（如 additionalRequirements）。

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill launches npx to fetch and execute the npm package @infimind/ecom-content-cli@latest at runtime (scripts/imiva_mcp.py), which downloads and runs remote code and is a required dependency.