ClawHub
Back to skill

Security audit

AI电商专家｜1688 批发电商 图片视频全内容

Security checks for vulnerabilities and agentic risk

Overview

The ecommerce workflow is coherent, but it runs unpinned remote MCP code with broad environment access and implicit activation enabled, so it needs user review before installation.

Install only if you trust the IMIVA npm MCP package and are comfortable with an authenticated tool that can read explicitly supplied local media files, upload them to the service, and create credit-consuming content tasks. Prefer pinning the npm package version, using a minimal environment, and requiring explicit confirmation before any task creation.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
env = os.environ.copy()
    env["MCP_TOKEN"] = token
    env["API_URL"] = os.environ.get("IMIVA_API_URL", os.environ.get("API_URL", DEFAULT_API_URL))
    proc = subprocess.Popen(
        [npx, "-y", PACKAGE],
        stdin=subprocess.PIPE,
        stdout=subprocess.PIPE,
Confidence
92% confidence
Finding
The script launches `npx -y @infimind/ecom-content-cli@latest`, which installs and executes the latest remote package at runtime. This creates a supply-chain risk: a compromised package, malicious dependency, or unexpected upstream update would execute arbitrary code with access to the inherited environment, including `MCP_TOKEN`. In this skill context, the danger is elevated because the tool is explicitly intended to handle enterprise ecommerce workflows and authenticated MCP access.

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill instructs users to run shell commands, read local files via paths, and rely on environment variables for secrets, but it does not declare corresponding permissions or capability requirements. This creates a transparency and consent gap: a host or user may invoke a skill that can access local material and sensitive configuration without clear upfront disclosure, increasing the chance of unintended file exposure or token misuse.

Vague Triggers

Medium
Confidence
77% confidence
Finding
The description includes a broad activation phrase ('Use this skill for IMIVA ecommerce content... workflows') that can cause the skill to trigger for a wide range of loosely related ecommerce requests. Over-broad routing is dangerous because it can cause unintended tool use, budget consumption, or exposure of local/remote media inputs in contexts where the user did not explicitly request this specific enterprise workflow.

Vague Triggers

Medium
Confidence
89% confidence
Finding
The skill enables implicit invocation with no visible activation constraints, so it may be triggered in broader contexts than the user intended. Because this skill can drive ecommerce content-generation workflows and tool usage, ambiguous auto-triggering can cause unintended execution, prompt-context leakage into the skill, or accidental use of external capabilities without clear user consent.

Env Variable Harvesting

High
Category
Data Exfiltration
Content
def invoke(method: str, params: dict | None = None) -> dict:
    npx, token = require_runtime()
    env = os.environ.copy()
    env["MCP_TOKEN"] = token
    env["API_URL"] = os.environ.get("IMIVA_API_URL", os.environ.get("API_URL", DEFAULT_API_URL))
    proc = subprocess.Popen(
Confidence
95% confidence
Finding
`os.environ.copy()` forwards the full parent environment to the child process, potentially exposing unrelated secrets, credentials, proxy settings, and internal configuration to the invoked Node package. In combination with executing `npx ... @latest`, this materially increases the blast radius of any compromised upstream package or malicious dependency, making secret leakage and environment harvesting much more dangerous.

Static analysis

No suspicious patterns detected.