cold-email

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.72). SKILL.md’s runtime workflow can pull “personalization material” via the ColdIQ MCP endpoints including mcp__coldiq__fetch_page_content/mcp__coldiq__extract_post_engagement, which will ingest outsider-authored web/page/post text into the agent context (indirect prompt-injection risk via retrieved content).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs running remote code ("COLDIQ_API_KEY= npx -y @coldiq/mcp@latest") and to call the ColdIQ API (https://api.coldiq.com) to fetch personalization material that the agent should use at runtime, so these external endpoints/packages can execute remote code and directly control prompts.