marketing-pipeline-automation

SUSPICIOUS: the skill’s capabilities fit its marketing-automation purpose, and the flagged command-injection items are documentation false positives. The main risk is install trust: users are directed to clone and npm-install a personal GitHub repository that does not clearly match the published skill owner, with limited release verification, so the supply chain is weaker than expected.