skills/wubin1836/ai-ecommerce-expert-agent-skills/ai-ecommerce-expert-white-background-product-image/Gen Agent Trust Hub
ai-ecommerce-expert-white-background-product-image
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npx -y @infimind/ecom-content-cli@latestto fetch the vendor's MCP client from the registry during execution. - [REMOTE_CODE_EXECUTION]: By downloading and running a remote package at runtime, the skill executes code that is not bundled within the local repository.
- [COMMAND_EXECUTION]: The script
scripts/imiva_mcp.pyusessubprocess.Popento launch the Node.js process and handle data flow between the agent and the external tool. - [PROMPT_INJECTION]: The skill accepts external image paths and user-defined prompts, creating a surface for indirect prompt injection.
- Ingestion points: The
imagesandpromptparameters passed tocreate_smart_refine_taskinSKILL.md. - Boundary markers: The instructions include guidelines for the agent to maintain product structural integrity and brand visual consistency.
- Capability inventory: The skill employs shell command execution and file system access to process e-commerce tasks.
- Sanitization: Input parameters are serialized into JSON before being passed to the subprocess, which helps prevent basic shell injection.
Audit Metadata