AI电商专家｜MCP 电商内容自动化

• Outcome: Review
• Latest audit: Aug 23, 2026 · 9:48 AM UTC
• Version: 1.0.0

Overview

The skill’s ecommerce automation purpose is coherent, but it runs an unpinned npm package and passes the user’s full environment into that process, which needs careful review before installation.

Review this skill before installing. Use it only in a clean environment with no unrelated secrets in environment variables, consider pinning the IMIVA npm package to a reviewed version, and require explicit confirmation before any task that may consume credits or access product data.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

env = os.environ.copy()
    env["MCP_TOKEN"] = token
    env["API_URL"] = os.environ.get("IMIVA_API_URL", os.environ.get("API_URL", DEFAULT_API_URL))
    proc = subprocess.Popen(
        [npx, "-y", PACKAGE],
        stdin=subprocess.PIPE,
        stdout=subprocess.PIPE,

• Confidence: 93% confidence
• Finding: proc = subprocess.Popen( [npx, "-y", PACKAGE], stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, bufsize=1,

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill instructs the user to run shell commands, read local files via $SKILL_PATH, and use environment variables for sensitive tokens, but it does not declare permissions or clearly scope these capabilities. This creates a trust and transparency gap: a host or user may not realize the skill can access local context and secrets, increasing the chance of unintended token exposure or unsafe execution in environments that rely on declared permissions.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The skill enables implicit invocation without any visible trigger scoping, consent gate, or narrow activation criteria. In a commerce automation skill that can query products and manage content-generation workflows, this increases the chance the agent invokes external business actions or accesses enterprise product context when the user did not explicitly request this specific integration.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The code performs external subprocess execution and implicitly downloads/runs an npm package from the network without any user-facing warning. Even if intended functionality requires this, the lack of disclosure increases the risk of users unknowingly executing remote code and exposing credentials or local environment data to that code.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

def invoke(method: str, params: dict | None = None) -> dict:
    npx, token = require_runtime()
    env = os.environ.copy()
    env["MCP_TOKEN"] = token
    env["API_URL"] = os.environ.get("IMIVA_API_URL", os.environ.get("API_URL", DEFAULT_API_URL))
    proc = subprocess.Popen(

• Confidence: 87% confidence
• Finding: os.environ.copy()

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.