sdr-master-prompts

SUSPICIOUS: The core prompt content is coherent for SDR messaging, and the ColdIQ API/domain use matches the stated sales-enrichment purpose. The main concern is trust: a prompt skill asks users to run an unpinned external MCP package and pass an API key into it, while public evidence for the exact npm package provenance is incomplete. This is a medium supply-chain and credential-forwarding risk, not confirmed malware.