ai-ecommerce-expert-white-background-product-image

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's runtime invokes npx to fetch and execute the remote package "@infimind/ecom-content-cli@latest" (via subprocess.Popen), which downloads and runs external code at runtime.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill exposes IMIVA MCP APIs that can query and consume user "credits" and submit tasks that deduct those credits. It explicitly documents calling get_user_credits, using dryRun/estimatedCredits, advising to "check credits before submitting", and setting an idempotencyKey and maxCredits (user-confirmed spending cap) when creating tasks. Those are specific platform billing controls and allow the agent to trigger chargeable operations — i.e., execute actions that spend user funds/credits.