Security audit
Security checks for vulnerabilities and agentic risk
The skill matches its IMIVA ecommerce content purpose, but it runs an unpinned external npm MCP helper with credentials and a broader inherited environment than necessary.
Install only if you trust the IMIVA service and the @infimind npm package. Prefer pinning the npm package version, running it with a minimal environment containing only MCP_TOKEN and API_URL, and using a scoped/revocable token. Confirm model, quantity, and credit budget before creating tasks, and only submit media you are authorized to upload.
env = os.environ.copy()
env["MCP_TOKEN"] = token
env["API_URL"] = os.environ.get("IMIVA_API_URL", os.environ.get("API_URL", DEFAULT_API_URL))
proc = subprocess.Popen(
[npx, "-y", PACKAGE],
stdin=subprocess.PIPE,
stdout=subprocess.PIPE,npx = shutil.which("npx")
if not npx:
raise SystemExit("未找到 npx。请先安装 Node.js 18 或更高版本。")
token = os.environ.get("MCP_TOKEN", "").strip()
if not token:
raise SystemExit("缺少 MCP_TOKEN。请在 IMIVA 的 MCP Token 页面创建后通过环境变量提供。")
return npx, tokendef invoke(method: str, params: dict | None = None) -> dict:
npx, token = require_runtime()
env = os.environ.copy()
env["MCP_TOKEN"] = token
env["API_URL"] = os.environ.get("IMIVA_API_URL", os.environ.get("API_URL", DEFAULT_API_URL))
proc = subprocess.Popen(No suspicious patterns detected.