linkedin-ads-copy

Warn

Audited by Socket on Jul 22, 2026

1 alert found:

Anomaly
AnomalyLOW
SKILL.md

SUSPICIOUS: the stated purpose is mostly coherent, and the ColdIQ API domain appears same-org and relevant to audience/ad research. But the skill expands into remote tool installation via unpinned `npx -y @coldiq/mcp@latest` and forwards an API key into that fetched package, creating medium supply-chain and credential-forwarding risk disproportionate to a simple copywriting guide.

Confidence: 82%Severity: 56%
Audit Metadata
Analyzed At
Jul 22, 2026, 06:40 PM
Package URL
pkg:socket/skills-sh/Cold-IQ%2FColdIQ-s-GTM-Skills%2Flinkedin-ads-copy%2F@70024ce7a20bab52f184342ead4a790d3197d739c929a6f67bea21c931683ae7
Security Audit — socket — linkedin-ads-copy