job-changes

SUSPICIOUS: The business purpose and capabilities are mostly aligned, but the install path asks users to execute an unpinned external MCP package and pass it an API key without strong independently verified package provenance in the provided evidence. Data flows to ColdIQ are consistent with the stated purpose, so this is not clearly malicious, but supply-chain and credential-forwarding risk are material.