excel-dcf-modeler

SUSPICIOUS. The skill’s purpose is coherent and there is no clear credential harvesting or exfiltration path, but it grants disproportionate `npx:*` execution and relies on an unrelated third-party MCP package to handle Excel operations. This looks more like a medium-risk supply-chain and permission-scoping issue than malware.