skills/cold-iq/coldiq-s-gtm-skills/lead-sources-guide/Socket

lead-sources-guide

Warn

Audited by Socket on Aug 14, 2026

1 alert found:

Security

SecuritySKILL.md

MEDIUM

SecurityMEDIUM

SKILL.md

SUSPICIOUS: the skill's purpose is coherent, but it couples a documentation-style guide to execution of an unpinned external MCP package and forwards an API key into that package. ColdIQ branding and endpoints look same-org, which lowers maliciousness, but the unverifiable package provenance keeps overall risk high.

Confidence: 83%Severity: 82%

Audit Metadata

Analyzed At

Aug 14, 2026, 05:22 AM

Package URL

pkg:socket/skills-sh/cold-iq%2Fcoldiq-s-gtm-skills%2Flead-sources-guide%2F@d14240fdf6f0e8651b602e0b9e3692ba0cfe79b4f73a3f3fb5cb0297d7699fe9