skills/cold-iq/coldiq-s-gtm-skills/define-icp/Socket

define-icp

Warn

Audited by Socket on Jul 22, 2026

1 alert found:

Security

SecuritySKILL.md

MEDIUM

SecurityMEDIUM

SKILL.md

SUSPICIOUS: The skill’s business purpose is coherent and its ColdIQ data flow is broadly aligned, but it asks users to execute an unpinned npm MCP package and pass an API key into it. With same-brand official domains but unverified package provenance, this is a supply-chain and credential-forwarding risk rather than confirmed malware.

Confidence: 84%Severity: 80%

Audit Metadata

Analyzed At

Jul 22, 2026, 06:40 PM

Package URL

pkg:socket/skills-sh/Cold-IQ%2FColdIQ-s-GTM-Skills%2Fdefine-icp%2F@519b5a2ac541239811f7044fa107960f1fe7d283ec5f221685b51a4f0dd23c75