Security audit
Security checks for vulnerabilities and agentic risk
This skill has a coherent ecommerce image-generation purpose, but it needs review because its helper can invoke broader IMIVA MCP tools and passes the full local environment to an unpinned npm package.
Install only if you trust IMIVA and the npm package publisher with your MCP token, local content paths, and any environment variables available in the terminal. Prefer a pinned package version, a minimal child environment, and a wrapper that allowlists only create_visual_migration_task plus necessary read-only credit/task status tools before using it for accounts with valuable credits or sensitive media.
def invoke(method: str, params: dict | None = None) -> dict:
npx, token = require_runtime()
env = os.environ.copy()
env["MCP_TOKEN"] = token
env["API_URL"] = os.environ.get("IMIVA_API_URL", os.environ.get("API_URL", DEFAULT_API_URL))
proc = subprocess.Popen(No suspicious patterns detected.