Security audit
Security checks for vulnerabilities and agentic risk
This skill appears purpose-aligned, but it needs review because it runs an unpinned external MCP package with the user's token and exposes broader IMIVA tool-calling than the headline workflow suggests.
Install only if you trust the IMIVA npm package and are comfortable giving it an MCP token that can create tasks and consume account credits. Use a scoped/revocable token, confirm costs before generation, avoid setting a generic API_URL to an unintended endpoint, and provide only media files you intend to upload.
env = os.environ.copy()
env["MCP_TOKEN"] = token
env["API_URL"] = os.environ.get("IMIVA_API_URL", os.environ.get("API_URL", DEFAULT_API_URL))
proc = subprocess.Popen(
[npx, "-y", PACKAGE],
stdin=subprocess.PIPE,
stdout=subprocess.PIPE,npx = shutil.which("npx")
if not npx:
raise SystemExit("未找到 npx。请先安装 Node.js 18 或更高版本。")
token = os.environ.get("MCP_TOKEN", "").strip()
if not token:
raise SystemExit("缺少 MCP_TOKEN。请在 IMIVA 的 MCP Token 页面创建后通过环境变量提供。")
return npx, tokendef invoke(method: str, params: dict | None = None) -> dict:
npx, token = require_runtime()
env = os.environ.copy()
env["MCP_TOKEN"] = token
env["API_URL"] = os.environ.get("IMIVA_API_URL", os.environ.get("API_URL", DEFAULT_API_URL))
proc = subprocess.Popen(No suspicious patterns detected.