activecampaign-automation-v2

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). The Rube MCP endpoint (https://rube.app/mcp) is a non-official service the skill tells operators to add and trust without authentication, which is potentially dangerous as it could serve or trigger untrusted code or downloads; the GitHub repository itself is a standard community source and not an explicit executable download.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs operators to add the MCP endpoint "https://rube.app/mcp" (SKILL.md:52), which is used at runtime as the Rube MCP server to provide tool schemas and execute toolkit actions — a required external runtime dependency that can directly control agent behavior and run remote operations.