mailchimp-marketing-api-toolkit

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (medium risk: 0.30). The skill document contains an installation command that fetches and executes an external script from an untrusted repository, which poses a supply chain risk.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (critical risk: 1.00). The installation instructions include a PowerShell download-and-execute command pointing to an untrusted external repository.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (critical risk: 1.00). The installation instructions include a remote PowerShell script execution from an unrelated third-party URL, which is a common obfuscation technique for delivering malicious payloads.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill instructs downloading and executing installation scripts from an arbitrary third-party GitHub repository (dustfinderfactory/Activate), which constitutes an unverified runtime external dependency.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The skill prompt contains a suspicious remote script execution command via PowerShell (irm ... | iex) pointing to an external factory repository, which is a common vector for machine compromise.