AI电商专家｜电商全内容一站式生成

• Outcome: Review
• Latest audit: Aug 23, 2026 · 9:33 AM UTC
• Version: 1.0.0

Overview

The skill fits an IMIVA ecommerce content workflow, but it should be reviewed because it can run a freshly downloaded npm package with your token and inherited environment variables.

Install only if you trust the IMIVA service and npm package, and are comfortable sending selected product assets and prompts to imiva.ecpro.com and spending account credits. Prefer a dedicated environment with no unrelated secrets, pin the npm package version if possible, and require explicit confirmation before submitting generation tasks.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

env = os.environ.copy()
    env["MCP_TOKEN"] = token
    env["API_URL"] = os.environ.get("IMIVA_API_URL", os.environ.get("API_URL", DEFAULT_API_URL))
    proc = subprocess.Popen(
        [npx, "-y", PACKAGE],
        stdin=subprocess.PIPE,
        stdout=subprocess.PIPE,

• Confidence: 88% confidence
• Finding: The script launches an external npm package at runtime using `npx -y @infimind/ecom-content-cli@latest`, which executes whatever code is currently published under `latest`. This creates a supply-chain and arbitrary-code-execution risk, especially because the subprocess is given a full environment including credentials and then performs token-backed network access.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill instructs the agent to use shell commands, read local files via paths, and access environment variables for tokens, but it does not declare any permissions or boundaries for those capabilities. This creates a mismatch between what the skill can induce the agent to do and what a reviewer or runtime policy can see, increasing the risk of unintended local file access, token exposure, or command execution beyond the user's intent.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The description is written broadly enough that the skill could be selected for many generic ecommerce-content requests, causing automatic invocation in situations where the user did not specifically ask for IMIVA or this vendor workflow. Over-broad triggering is dangerous because it can route unrelated requests into a skill that encourages tool use, local file handling, and external service interaction, increasing the chance of unnecessary data exposure or unintended actions.

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: The target-user and search-coverage sections enumerate a very large set of platforms, models, brands, and generic marketing intents, which can cause the skill to match far outside its core purpose. In context, this makes the skill more dangerous because it is not just informational: it is designed to drive MCP tool calls and can involve local paths, URLs, task submission, and billing-related operations.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The skill enables implicit invocation with no visible trigger constraints, exclusions, or consent gating. In a commerce workflow, this can cause the agent to invoke the skill unexpectedly on loosely related prompts and potentially route user-provided product assets or business context into external content-generation actions without clear user intent.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: This code silently executes a third-party package and allows it to use an authentication token for remote API access, without any explicit user-facing disclosure at execution time. In a skill context, that reduces informed consent and makes it easier for users or operators to unknowingly grant a freshly downloaded package access to sensitive data or paid API capabilities.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

def invoke(method: str, params: dict | None = None) -> dict:
    npx, token = require_runtime()
    env = os.environ.copy()
    env["MCP_TOKEN"] = token
    env["API_URL"] = os.environ.get("IMIVA_API_URL", os.environ.get("API_URL", DEFAULT_API_URL))
    proc = subprocess.Popen(

• Confidence: 86% confidence
• Finding: Copying the entire process environment and passing it into a dynamically executed external package can expose unrelated secrets, credentials, proxy settings, or internal configuration to untrusted child code. In this skill, that risk is amplified because the child process is an npm package fetched/executed via `npx`, so a compromised package or dependency could exfiltrate all inherited environment variables.

Static analysis

No suspicious patterns detected.