cold-email-outreach

SUSPICIOUS. The skill is broadly aligned with outbound email automation, but it handles sensitive lead data, uses a high-privilege Supabase service role, invokes another skill transitively, and can perform real-world email campaign actions. Data flows mostly match stated purpose and there is an explicit launch gate, so this is not confirmed malicious; however, the transitive skill dependency and unverified Smartlead MCP configuration keep risk at medium.