skills/cold-iq/coldiq-s-gtm-skills/lead-sources-guide/Socket

lead-sources-guide

Warn

Audited by Socket on Jul 22, 2026

1 alert found:

Security

SecuritySKILL.md

MEDIUM

SecurityMEDIUM

SKILL.md

SUSPICIOUS: the skill's purpose is coherent, but it couples a documentation-style guide to execution of an unpinned external MCP package and forwards an API key into that package. ColdIQ branding and endpoints look same-org, which lowers maliciousness, but the unverifiable package provenance keeps overall risk high.

Confidence: 83%Severity: 82%

Audit Metadata

Analyzed At

Jul 22, 2026, 06:38 PM

Package URL

pkg:socket/skills-sh/Cold-IQ%2FColdIQ-s-GTM-Skills%2Flead-sources-guide%2F@c8f1e7a41fa4142e811d258333b61403d46a540be272ce79a13882e75863a230