AI电商专家｜批量 SKU 内容生产

• Outcome: Review
• Latest audit: Aug 23, 2026 · 9:48 AM UTC
• Version: 1.0.0

Overview

The skill is coherent for IMIVA ecommerce content generation, but it should be reviewed carefully because it runs an unpinned npm package and forwards the full local environment to it.

Install only if you trust the IMIVA npm package and are comfortable with it using your MCP token and local product assets. Prefer pinning the npm package version, running it in a clean environment containing only MCP_TOKEN, API_URL, and required PATH, and confirming credit-consuming tasks before creation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

env = os.environ.copy()
    env["MCP_TOKEN"] = token
    env["API_URL"] = os.environ.get("IMIVA_API_URL", os.environ.get("API_URL", DEFAULT_API_URL))
    proc = subprocess.Popen(
        [npx, "-y", PACKAGE],
        stdin=subprocess.PIPE,
        stdout=subprocess.PIPE,

• Confidence: 93% confidence
• Finding: The script launches `npx -y @infimind/ecom-content-cli@latest`, which executes code fetched from the npm ecosystem at runtime. Using `@latest` and auto-confirming install means the exact code executed can change over time and could be replaced by a compromised or malicious package, leading to arbitrary code execution with access to the inherited environment and local files.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill instructs the client to use shell commands, read local files, and consume environment variables such as MCP_TOKEN, but it does not declare these capabilities as permissions. That creates a transparency and consent gap: a host or reviewer may treat the skill as low-privilege while it actually relies on access to sensitive local resources and command execution. In this enterprise MCP context, the risk is elevated because the workflow explicitly handles local asset paths and authentication tokens.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This file silently executes a remote npm package through `npx` without any user-facing warning, confirmation, or trust boundary disclosure. In a security-sensitive enterprise workflow, that can mislead operators into running third-party code they did not knowingly approve, increasing supply-chain and arbitrary-code-execution risk.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script forwards `MCP_TOKEN` to the spawned child process without explicit disclosure in the CLI flow. If the npm package is compromised or behaves unexpectedly, the token can be exfiltrated and then used to access IMIVA MCP capabilities under the victim's account.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

def invoke(method: str, params: dict | None = None) -> dict:
    npx, token = require_runtime()
    env = os.environ.copy()
    env["MCP_TOKEN"] = token
    env["API_URL"] = os.environ.get("IMIVA_API_URL", os.environ.get("API_URL", DEFAULT_API_URL))
    proc = subprocess.Popen(

• Confidence: 89% confidence
• Finding: Copying the entire parent environment into the child process unnecessarily exposes all ambient secrets and configuration, not just the intended MCP token. Because the child process is a runtime-fetched npm package, this broad environment inheritance expands the blast radius of any package compromise or unexpected behavior.

Static analysis

No suspicious patterns detected.