AI电商专家｜Amazon 亚马逊 图片视频全内容

• Outcome: Review
• Latest audit: Aug 23, 2026 · 9:43 AM UTC
• Version: 1.0.0

Overview

The skill is coherent for IMIVA ecommerce content generation, but it needs Review because it runs a dynamically fetched MCP package while exposing the full local environment to it.

Install only if you trust IMIVA and the npm package publisher, and prefer pinning a specific package version plus restricting environment variables before use. Treat submitted product images, videos, prompts, and the MCP token as data sent to IMIVA, and confirm credits before any generation task.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

env = os.environ.copy()
    env["MCP_TOKEN"] = token
    env["API_URL"] = os.environ.get("IMIVA_API_URL", os.environ.get("API_URL", DEFAULT_API_URL))
    proc = subprocess.Popen(
        [npx, "-y", PACKAGE],
        stdin=subprocess.PIPE,
        stdout=subprocess.PIPE,

• Confidence: 84% confidence
• Finding: The script executes `npx -y @infimind/ecom-content-cli@latest`, which downloads and runs the latest package version at runtime without pinning integrity or version. This creates a software supply-chain risk: if the upstream package is compromised or a breaking/malicious release is published, the skill will execute attacker-controlled code with access to the inherited environment, including `MCP_TOKEN`.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill instructs users to invoke shell commands, read local files via paths, and use environment variables for secrets, yet it declares no permissions or capability boundaries. This creates a trust and consent gap: an agent may access local files or secrets unexpectedly, and users are not clearly warned that local execution and token handling are required.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The skill description is extremely broad, covering many ecommerce content workflows and multiple marketplaces, which makes it easier for an agent to invoke it outside a narrowly intended user request. Overly broad trigger conditions can cause unexpected tool use, unnecessary data exposure, or accidental task creation that may incur cost.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The skill enables allow_implicit_invocation without any visible trigger constraints, exclusions, or approval gates. That can cause the skill to activate in broader user contexts than intended, increasing the chance of unintended handling of ecommerce data, accidental tool use, or prompt-routing into a powerful content-generation workflow without clear user consent.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

def invoke(method: str, params: dict | None = None) -> dict:
    npx, token = require_runtime()
    env = os.environ.copy()
    env["MCP_TOKEN"] = token
    env["API_URL"] = os.environ.get("IMIVA_API_URL", os.environ.get("API_URL", DEFAULT_API_URL))
    proc = subprocess.Popen(

• Confidence: 82% confidence
• Finding: Copying the full parent environment with `os.environ.copy()` and passing it to a dynamically fetched subprocess unnecessarily exposes all ambient secrets and configuration to that child process. In this skill's context, this is more dangerous because the child is started via `npx` with `@latest`, so a compromised dependency could read and exfiltrate unrelated credentials from the inherited environment.

Static analysis

No suspicious patterns detected.