oci-order-detail-query

SUSPICIOUS. The core analytics purpose is coherent, and the DuckDB installer is official, but the skill handles plaintext database credentials via ~/.duckdbrc, tells the agent to display that file, and combines shell-executed query strings with user-supplied parameters. This looks more like a risky internal data-access skill than malware: medium security risk, low-to-moderate maliciousness evidence.