cost-gcp

SUSPICIOUS. The core Google CLI and Billing API flows are legitimate and proportionate for GCP cost estimation, but the skill also instructs installation of unverified third-party MCP packages via `uvx`, including one with a strongly inconsistent PyPI description. That unverifiable install path is not necessary to the stated purpose and materially raises supply-chain risk, even though the documented Google API data flow itself is benign.