Security audit
Security checks across malware telemetry and agentic risk
This skill connects to IMIVA for ecommerce media generation, but it exposes broader paid MCP actions and environment access than the main-image A/B testing purpose clearly scopes.
Review before installing. Use a dedicated IMIVA token, run it from an environment that does not contain unrelated secrets, confirm credit costs before creating tasks, and consider pinning the NPM package version and limiting use to the intended IMIVA tools.
env = os.environ.copy()
env["MCP_TOKEN"] = token
env["API_URL"] = os.environ.get("IMIVA_API_URL", os.environ.get("API_URL", DEFAULT_API_URL))
proc = subprocess.Popen(
[npx, "-y", PACKAGE],
stdin=subprocess.PIPE,
stdout=subprocess.PIPE,npx = shutil.which("npx")
if not npx:
raise SystemExit("未找到 npx。请先安装 Node.js 18 或更高版本。")
token = os.environ.get("MCP_TOKEN", "").strip()
if not token:
raise SystemExit("缺少 MCP_TOKEN。请在 IMIVA 的 MCP Token 页面创建后通过环境变量提供。")
return npx, tokendef invoke(method: str, params: dict | None = None) -> dict:
npx, token = require_runtime()
env = os.environ.copy()
env["MCP_TOKEN"] = token
env["API_URL"] = os.environ.get("IMIVA_API_URL", os.environ.get("API_URL", DEFAULT_API_URL))
proc = subprocess.Popen(VirusTotal findings are pending for this skill version.
No suspicious patterns detected.