skills/wubin1836/ai-ecommerce-expert-agent-skills/ai-ecommerce-expert-zero-basis-case-learning/Gen Agent Trust Hub
ai-ecommerce-expert-zero-basis-case-learning
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/imiva_mcp.pyusessubprocess.Popento executenpx. This is used to wrap the official IMIVA MCP command-line interface for tool invocation. - [EXTERNAL_DOWNLOADS]: The skill configuration and helper scripts utilize
npx -y @infimind/ecom-content-cli@latestto fetch and run the official vendor package from the NPM registry. This ensures the latest version of the content generation tools is available. - [REMOTE_CODE_EXECUTION]: The use of
npxto execute a remote package constitutes remote code execution. This behavior is the primary intended mechanism for the skill to interact with the IMIVA platform and targets the official package provided by the service vendor. - [INDIRECT_PROMPT_INJECTION]: The skill provides an attack surface for indirect prompt injection as it ingests user-supplied prompts and image paths in the
create_smart_refine_taskfunction. No specific exploits were found, but the agent processes external content as part of its core workflow.
Audit Metadata