bridgebound-relationship-39

SUSPICIOUS: the skill's purpose and core capabilities mostly align, but it embeds an execution path that runs an unpinned npm package and forwards an API key to that package. Data flows appear first-party and consistent with ColdIQ's service, so this is not confirmed malicious, but the install-trust and credential-forwarding model create meaningful medium risk.