gtm-plays-11
Pass
Audited by Gen Agent Trust Hub on Jul 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to install the
@coldiq/mcppackage usingnpx. This is a vendor-owned resource provided by the author to support the skill's features. - [PROMPT_INJECTION]: The skill is designed to ingest data from external sources such as G2 reviews and social media profiles, which introduces an indirect prompt injection surface.
- Ingestion points: Processes external inputs from reviews and LinkedIn profile data in Play #2 and Play #8.
- Boundary markers: Templates interpolate data directly into message bodies without specific isolation markers or safety instructions.
- Capability inventory: Uses the
mcp__coldiq__*tool suite for data enrichment and automated searches. - Sanitization: No explicit sanitization or validation of external content is defined in the skill logic.
Audit Metadata