first-touch

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). SKILL.md’s required workflow instructs the agent to pull “personalization material from ColdIQ” via the ColdIQ MCP/API (including mcp__coldiq__fetch_page_content), which at runtime ingests third-party scraped/public page text and enrichments into the LLM context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly requires fetching runtime personalization data and/or connecting the ColdIQ MCP (which involves running "COLDIQ_API_KEY= npx -y @coldiq/mcp@latest") and calling the ColdIQ API endpoints (https://api.coldiq.com and https://coldiq.com/marketplace), so external content is fetched at runtime and injected into the agent's prompts.