The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructions and the helper script scripts/imiva_mcp.py utilize npx to download and run the @infimind/ecom-content-cli@latest package. This fetches the most recent version of the code from the public NPM registry at runtime.
[COMMAND_EXECUTION]: The script scripts/imiva_mcp.py uses the subprocess.Popen function to launch the npx command. This facilitates the execution of the external MCP tool within the local environment.
[REMOTE_CODE_EXECUTION]: By invoking npx -y @infimind/ecom-content-cli@latest, the skill performs remote code execution by fetching and executing a third-party binary package directly from a remote registry.
[PROMPT_INJECTION]: The skill acts as an interface for generating social media notes by ingesting user-provided data including image paths, product names, and marketing copy, creating a surface for indirect prompt injection.
Ingestion points: Data enters the system through the args parameter in the call command, including fields like images, productName, and sellingPoints in scripts/imiva_mcp.py.
Boundary markers: The skill does not implement specific delimiters or explicit instructions to the model to ignore potential commands embedded within the product data.
Capability inventory: The skill possesses the capability to execute shell commands via subprocess.Popen in scripts/imiva_mcp.py.
Sanitization: Input data is converted to JSON and passed to the external tool without visible sanitization or validation of the content.

ai-ecommerce-expert-xiaohongshu-note-package