Security audit
Security checks across malware telemetry and agentic risk
The skill mostly matches its ecommerce content-generation purpose, but its helper script runs a mutable npm package with broad inherited environment access, which could expose unrelated local secrets.
Install only if you trust IMIVA and the npm package source. Use a dedicated terminal or MCP client profile with only the required MCP_TOKEN and API_URL environment variables, avoid running it from shells that contain cloud or CI secrets, and be aware that local product images or videos you provide may be uploaded to IMIVA for processing and may consume platform credits.
def invoke(method: str, params: dict | None = None) -> dict:
npx, token = require_runtime()
env = os.environ.copy()
env["MCP_TOKEN"] = token
env["API_URL"] = os.environ.get("IMIVA_API_URL", os.environ.get("API_URL", DEFAULT_API_URL))
proc = subprocess.Popen(VirusTotal findings are pending for this skill version.
No suspicious patterns detected.