The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The script scripts/imiva_mcp.py is configured to download and execute the latest version of the @infimind/ecom-content-cli package from the NPM registry using npx -y during runtime. This creates a dependency on remote code that is not pinned to a specific version.
[COMMAND_EXECUTION]: The skill uses subprocess.Popen in scripts/imiva_mcp.py to launch shell commands (specifically npx). This pattern is used to wrap the functionality of the Node.js CLI tool for the agent.
[DATA_EXFILTRATION]: The skill manages a sensitive authentication token (MCP_TOKEN) and transmits it, along with user-provided product data, to the external service at imiva.ecpro.com. While standard for this type of integration, it constitutes a data flow to an external third-party domain.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted product metadata (such as names, categories, and selling points) which is subsequently used as input for AI content generation tasks. The lack of explicit sanitization or boundary markers in the interpolation process creates a potential surface for indirect prompt injection if the input data is sourced from an untrusted third party.

ai-ecommerce-expert-xiaohongshu-ecommerce-content