inbound-triggers-30
Pass
Audited by Gen Agent Trust Hub on Jul 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to execute
npx -y @coldiq/mcp@latest. This command downloads and runs the official Model Context Protocol server from the skill's author (Cold-IQ) via the npm registry to enable intent detection and web search capabilities.- [PROMPT_INJECTION]: The skill contains a surface for indirect prompt injection as it utilizes tools designed to ingest untrusted data from external sources. - Ingestion points: External data is ingested through the
mcp__coldiq__find_signalsandmcp__coldiq__search_webtools referenced in SKILL.md. - Boundary markers: No specific boundary markers or instructions to ignore embedded commands are present in the skill's instructions.
- Capability inventory: The skill uses tools for email discovery and verification (
mcp__coldiq__find_emails,mcp__coldiq__verify_email) based on the ingested signals. - Sanitization: There are no documented sanitization or validation steps for the content retrieved from external signals or web searches.
Audit Metadata