abm-strategy
Pass
Audited by Gen Agent Trust Hub on Jul 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill mentions the
@coldiq/mcppackage, which is hosted on the public npm registry. - [REMOTE_CODE_EXECUTION]: Includes an instruction to use
npx -y @coldiq/mcp@latestto execute the vendor's MCP server directly from the registry. This is a standard deployment method for the vendor's tools. - [COMMAND_EXECUTION]: Provides a terminal command for users to manually initialize the Cold-IQ MCP environment.
- [DATA_EXFILTRATION]: Interfaces with the vendor's API endpoint at
api.coldiq.comto perform business-related data enrichment tasks, which is part of the skill's intended functionality. - [PROMPT_INJECTION]: The skill processes potentially untrusted user queries and reads from internal documentation to provide its services.
- Ingestion points: User input and internal files in the
references/directory. - Boundary markers: No specific delimiters are employed to isolate external data from instructions.
- Capability inventory: Access to vendor MCP tools for data retrieval and company enrichment.
- Sanitization: No sanitization mechanisms are defined for the data processed from reference files.
Audit Metadata