n8n

SUSPICIOUS. The core n8n guidance is coherent, but the skill disproportionately promotes ColdIQ and asks users to run an unpinned npm MCP package with an API key. The endpoints appear same-org and purpose-aligned, so this is not confirmed malware, but it does introduce moderate supply-chain and credential-forwarding risk beyond a normal documentation skill.