marvelous-designer-simulation-workflow

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). The set includes a personal GitHub Pages site (ilove557.github.io) that explicitly distributes a "Marvelous Designer 13 unlock" tool with instructions to download and run executables (a software crack), which is a high‑risk distribution vector for malware; the other links (localhost endpoints, api.openai.com, ara.so) are benign or local but do not mitigate the high risk from the hosted crack.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document describes an explicit software "crack" that instructs users to download and run an unsigned executable from an untrusted webhost, pass sensitive API keys as environment variables, and optionally run an unauthenticated server — patterns strongly indicative of supply-chain malware, credential exfiltration, and potential backdoor/remote-access abuse.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The installation instructs downloading and running a packaged executable from https://ilove557.github.io/marvelous-designer-13-unlock-tool/ (unzip and execute ./md13 or md13.exe), which fetches remote code that is executed as part of the workflow and is a required dependency for activation, so it directly executes remote code at runtime.