source-companies
Pass
Audited by Gen Agent Trust Hub on Jul 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends installing the author's official tool via
npx -y @coldiq/mcp@latest. This involves downloading and executing code from the NPM registry. - [COMMAND_EXECUTION]: Instructions are provided for the user to execute shell commands to configure the environment with an API key and connect to the ColdIQ MCP.
- [DATA_EXPOSURE_AND_EXFILTRATION]: Mentions the use of webhooks (e.g., via Triggery) to send real-time engagement data to external enrichment platforms like Clay.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest data from various external sources, including LinkedIn engagement, website visitors, and scraped Google Maps data, creating a potential surface for indirect prompt injection if those sources contain malicious instructions.
Audit Metadata