Security audit
Security checks across malware telemetry and agentic risk
The skill’s ecommerce image/video workflow is mostly coherent, but it uses an unpinned external MCP package with broad inherited environment access and automatic invocation enabled.
Review this before installing if your agent environment contains sensitive environment variables or if you do not want a skill that can be invoked implicitly for paid ecommerce content generation. Use a scoped token, run it in a clean environment, and prefer pinning or reviewing the external MCP package before use.
def invoke(method: str, params: dict | None = None) -> dict:
npx, token = require_runtime()
env = os.environ.copy()
env["MCP_TOKEN"] = token
env["API_URL"] = os.environ.get("IMIVA_API_URL", os.environ.get("API_URL", DEFAULT_API_URL))
proc = subprocess.Popen(VirusTotal findings are pending for this skill version.
No suspicious patterns detected.