inbound-triggers-30

SUSPICIOUS. The skill’s marketing/prospecting purpose is coherent, but it couples a mostly informational taxonomy with an unpinned `npx` install that fetches and executes a remote MCP package, then forwards an API key into that runtime. Data flows are broadly consistent with ColdIQ’s service, but install trust and credential forwarding make the skill medium-high risk rather than benign.