linkedin-ads-bidding

SUSPICIOUS: the core guidance is benign marketing advice, but the skill’s footprint is broader than its stated LinkedIn bidding purpose because it pushes optional installation of external ColdIQ MCP tooling and credential use. Data flows stay within same-brand ColdIQ endpoints, so this is not clearly malicious, but the unpinned `npx` execution and third-party credential forwarding make it medium risk.