splunk-search

SUSPICIOUS. The stated purpose is coherent for a Splunk query skill, but the install/execution path is not: it fetches and runs an unverified `splunk-mcp` package via npx, while the evidence points to different official Splunk MCP connection methods and auth patterns. Because this external runtime would receive Splunk credentials, the skill has high supply-chain and credential-forwarding risk even without proof of confirmed malware.