商品页转化率优化

• Outcome: Review
• Latest audit: Sep 1, 2026 · 1:13 PM UTC
• Version: 1.0.0

Overview

The skill is a coherent IMIVA ecommerce-content integration, but it should be reviewed because it runs an unpinned external npm CLI with broad inherited environment access and allows implicit invocation.

Install only if you trust the IMIVA npm package and are comfortable providing an MCP token and product materials. Prefer a pinned CLI version, run it with a minimal environment containing only MCP_TOKEN, API_URL or IMIVA_API_URL, and PATH, and require explicit confirmation before creating paid tasks.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (5)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

env = os.environ.copy()
    env["MCP_TOKEN"] = token
    env["API_URL"] = os.environ.get("IMIVA_API_URL", os.environ.get("API_URL", DEFAULT_API_URL))
    proc = subprocess.Popen(
        [npx, "-y", PACKAGE],
        stdin=subprocess.PIPE,
        stdout=subprocess.PIPE,

• Confidence: 94% confidence
• Finding: The script spawns an external process that fetches and executes a package via `npx`, which materially expands trust to the local Node/npm toolchain and the remote npm registry. Because the package reference uses `@latest`, behavior can change over time and a compromised upstream package or dependency could execute arbitrary code with the user's environment and token available.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill instructs the user to run shell commands, read local files via paths, and use environment variables for secrets, but it does not declare corresponding permissions. This creates a capability/permission mismatch: hosts or reviewers may underestimate what the skill can access, and users may expose local files or tokens without clear, explicit permission scoping.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: This helper's core function is to invoke an external npm-delivered CLI, giving the skill a code-execution and network-fetch capability broader than simple local PDP-content formatting. In this skill context, that is relevant because the skill is expected to help create ecommerce content, but the implementation delegates trust to remotely resolved third-party code at runtime.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The skill enables allow_implicit_invocation without any visible trigger constraints, allowing the agent platform to activate it based on broad relevance rather than explicit user intent. Because this skill can drive commercial content generation and task creation workflows, unintended invocation could cause unrequested actions, data collection, or budget-related operations on the wrong user query.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

def invoke(method: str, params: dict | None = None) -> dict:
    npx, token = require_runtime()
    env = os.environ.copy()
    env["MCP_TOKEN"] = token
    env["API_URL"] = os.environ.get("IMIVA_API_URL", os.environ.get("API_URL", DEFAULT_API_URL))
    proc = subprocess.Popen(

• Confidence: 95% confidence
• Finding: Copying the full parent environment into the child process unnecessarily exposes all ambient secrets and configuration to an externally fetched npm package. In this skill context, that is more dangerous because the helper then executes code resolved at runtime via `npx`, so any compromised package or dependency can read and exfiltrate unrelated credentials from the inherited environment.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.