ClawHub
Back to skill

Security audit

AI电商专家｜批量商品视频变体

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for IMIVA video generation, but it runs a remotely resolved npm package with an IMIVA token while forwarding the full local environment.

Install only if you are comfortable running an npm package from the registry with your IMIVA token. Use a restricted environment with only the required variables, consider pinning the npm package version, and confirm costs before any non-dry-run video task.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
env = os.environ.copy()
    env["MCP_TOKEN"] = token
    env["API_URL"] = os.environ.get("IMIVA_API_URL", os.environ.get("API_URL", DEFAULT_API_URL))
    proc = subprocess.Popen(
        [npx, "-y", PACKAGE],
        stdin=subprocess.PIPE,
        stdout=subprocess.PIPE,
Confidence
89% confidence
Finding
The script launches an external Node package via `npx -y @infimind/ecom-content-cli@latest`, which implicitly trusts and executes whatever code is currently published under that package/version tag. Because it also passes API credentials and inherited environment variables into that child process, a compromised package, dependency, or registry response could exfiltrate secrets or perform unintended actions.

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill instructs users to run shell commands, read local files via $SKILL_PATH, and configure secrets through environment variables, yet it declares no explicit permissions or safety boundaries. This can cause an agent or user to execute privileged local actions without clear consent or sandboxing expectations, increasing the risk of unintended file access, token exposure, or command execution.

Vague Triggers

Medium
Confidence
85% confidence
Finding
The description uses broad activation language such as 'Use this skill for IMIVA ecommerce content' across many workflows without clear trigger conditions or user-consent boundaries. Over-broad routing can cause an agent to invoke this skill in situations the user did not specifically request, potentially sending sensitive business materials, local file paths, or external URLs into third-party tooling unnecessarily.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
This script sends `MCP_TOKEN` to a package fetched/executed through `npx` without any confirmation, trust prompt, or provenance validation. In an enterprise ecommerce skill context, that increases supply-chain risk because a user may unknowingly grant a freshly downloaded package access to production content-generation APIs and potentially other inherited secrets.

Env Variable Harvesting

High
Category
Data Exfiltration
Content
def invoke(method: str, params: dict | None = None) -> dict:
    npx, token = require_runtime()
    env = os.environ.copy()
    env["MCP_TOKEN"] = token
    env["API_URL"] = os.environ.get("IMIVA_API_URL", os.environ.get("API_URL", DEFAULT_API_URL))
    proc = subprocess.Popen(
Confidence
94% confidence
Finding
Using `os.environ.copy()` forwards the entire parent environment to the spawned `npx` process, potentially exposing unrelated secrets such as cloud credentials, CI tokens, proxy credentials, and internal configuration. In combination with executing a remotely resolved package, this materially increases the blast radius of any package compromise or malicious dependency behavior.

Static analysis

No suspicious patterns detected.