AI电商专家｜中文文字广告图

• Outcome: Review
• Latest audit: Aug 23, 2026 · 9:48 AM UTC
• Version: 1.0.0

Overview

The skill matches its ecommerce ad-image purpose, but it runs a mutable external npm tool while exposing broad local environment variables and under-documents its effective tool scope.

Review this skill before installing in a sensitive environment. Use a dedicated low-privilege IMIVA token, avoid running the helper from a shell containing unrelated secrets, and prefer a pinned or pre-reviewed version of the npm package where possible. Only provide local product files you intend to send through the IMIVA workflow.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

env = os.environ.copy()
    env["MCP_TOKEN"] = token
    env["API_URL"] = os.environ.get("IMIVA_API_URL", os.environ.get("API_URL", DEFAULT_API_URL))
    proc = subprocess.Popen(
        [npx, "-y", PACKAGE],
        stdin=subprocess.PIPE,
        stdout=subprocess.PIPE,

• Confidence: 92% confidence
• Finding: The script spawns `npx -y @infimind/ecom-content-cli@latest`, which executes code fetched/resolved from the Node ecosystem at runtime. Even though `shell=True` is not used, this still creates a supply-chain and arbitrary code execution risk because `latest` is mutable and the child process runs with the caller's privileges and inherited environment.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill documents shell commands, environment-variable usage, and local file path handling, yet it declares no explicit permissions. This creates a capability/permission mismatch that can cause users or orchestrators to invoke shell, read local files, or access secrets without clear consent boundaries, increasing the chance of unintended data exposure or unsafe execution.

Intent-Code Divergence

Medium

• Confidence: 77% confidence
• Finding: The documentation claims the real MCP capability is only create_smart_refine_task, while later instructing use of get_user_credits and get_user_tasks. This inconsistency can undermine tool allowlisting and security review assumptions, leading an agent or reviewer to authorize a skill under a narrower capability model than it actually uses.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The helper silently launches a network-resolved package via `npx`, so a user invoking this Python script may not realize it is downloading and executing third-party code. That lack of disclosure increases the chance of unsafe execution in sensitive environments and magnifies the effect of package compromise or typosquatting.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script forwards `MCP_TOKEN` and API endpoint configuration into a child process and then makes remote MCP calls, but does not explicitly disclose that credentials are being handed to another executable and transmitted to a remote service. If the npm package or endpoint is compromised, the token could be exposed or misused.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

def invoke(method: str, params: dict | None = None) -> dict:
    npx, token = require_runtime()
    env = os.environ.copy()
    env["MCP_TOKEN"] = token
    env["API_URL"] = os.environ.get("IMIVA_API_URL", os.environ.get("API_URL", DEFAULT_API_URL))
    proc = subprocess.Popen(

• Confidence: 84% confidence
• Finding: Copying the full parent environment into the child process unnecessarily exposes all ambient secrets and configuration to the npm-executed package, not just the MCP token. In a supply-chain compromise scenario, this broad environment inheritance could leak unrelated credentials and increase blast radius.

Static analysis

No suspicious patterns detected.