AI电商专家｜美妆护肤电商图片视频

• Outcome: Review
• Latest audit: Aug 23, 2026 · 9:48 AM UTC
• Version: 1.0.0

Overview

The skill fits an IMIVA ecommerce content workflow, but it needs Review because it runs a mutable external npm tool with broad environment access and exposes broader MCP control than its narrow beauty-content framing suggests.

Install only if you trust the IMIVA npm package and are comfortable giving this skill an MCP token that may create paid content tasks and query account/task data. Prefer a limited token, keep it out of chats and repos, review available tools with list-tools, and avoid running the helper from an environment containing unrelated secrets.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

env = os.environ.copy()
    env["MCP_TOKEN"] = token
    env["API_URL"] = os.environ.get("IMIVA_API_URL", os.environ.get("API_URL", DEFAULT_API_URL))
    proc = subprocess.Popen(
        [npx, "-y", PACKAGE],
        stdin=subprocess.PIPE,
        stdout=subprocess.PIPE,

• Confidence: 92% confidence
• Finding: The script executes an external npm package via `npx -y @infimind/ecom-content-cli@latest`, which can download and run code at invocation time. Because it uses the mutable `latest` tag and forwards sensitive environment variables to the child process, compromise of the package, its dependencies, or the registry path would directly expose the MCP token and allow arbitrary code execution in the user's environment.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill documents shell execution, environment variable access, and local file path handling without declaring corresponding permissions or constraining their use. This creates an under-specified trust boundary: a user or host may believe the skill is narrowly scoped content generation, while it can access sensitive local resources and credentials needed to run arbitrary MCP commands.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The skill is presented as a narrowly scoped beauty/skincare ecommerce generator, but the documentation exposes behavior for listing all tools available to the token and invoking arbitrary MCP tools. That mismatch is dangerous because it can trick users into granting a broad enterprise token to what appears to be a single-purpose skill, enabling unintended actions beyond the advertised workflow.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The manifest claims automatic use of only create_koc_note_package_task, but the body documents broader support for additional content-generation and account-query tools. This inconsistency can mislead users and reviewers about the real operational scope, causing overbroad token exposure and unexpected access to account metadata such as credits and task history.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The wrapper exposes arbitrary MCP tool invocation through `call <tool>`, despite the skill metadata claiming a narrower create_koc_note_package_task-focused capability. This expands the effective privilege surface: any tool available to the token can be invoked, enabling unintended operations if users or higher-level agents trust the manifest's narrower description.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The skill enables implicit invocation (`allow_implicit_invocation: true`) without any visible activation guardrails, scope restrictions, or user-confirmation requirements. In a commerce workflow, this can cause the agent to auto-route user requests into a specialized skill that may trigger downstream content-generation/tooling behavior unexpectedly, increasing the risk of unintended actions, privacy exposure, or user confusion about which system is acting.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script silently uses `npx` to fetch and execute an external package, which means running the tool can trigger unreviewed code download and execution. In a skill context, this is especially dangerous because users may expect a local helper script, not dynamic remote code execution with access to their MCP credentials and environment.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

def invoke(method: str, params: dict | None = None) -> dict:
    npx, token = require_runtime()
    env = os.environ.copy()
    env["MCP_TOKEN"] = token
    env["API_URL"] = os.environ.get("IMIVA_API_URL", os.environ.get("API_URL", DEFAULT_API_URL))
    proc = subprocess.Popen(

• Confidence: 95% confidence
• Finding: The script copies the entire parent environment and passes it to a child process that may be dynamically downloaded via `npx`. This can leak not only `MCP_TOKEN` but any other secrets in the runtime environment to third-party code, substantially increasing blast radius if the package or dependency chain is compromised.

Static analysis

No suspicious patterns detected.