multi-signal
Pass
Audited by Gen Agent Trust Hub on Jul 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions for users to install the
@coldiq/mcppackage from the NPM registry usingnpx. This is a legitimate vendor resource provided by Cold-IQ for integrating their signal-sourcing capabilities. - [PROMPT_INJECTION]: The skill is designed to ingest and process data from external sources, such as intent signals and web search results, which introduces a surface for indirect prompt injection.
- Ingestion points:
SKILL.md(instructions for callingmcp__coldiq__find_signalsandmcp__coldiq__search_webtools). - Boundary markers: None explicitly defined to separate untrusted tool outputs from instructions.
- Capability inventory: Data analysis, lead scoring calculation, and response generation; no high-privilege operations like file system writes or arbitrary command execution are granted to the agent based on the ingested data.
- Sanitization: No specific filtering or sanitization protocols for external content are mentioned in the skill definition.
Audit Metadata