databricks-cost-leak-hunter
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
Bashtool, restricted specifically to thedatabricksCLI andjqutility, to interact with the Databricks Statement Execution API and manipulate JSON-formatted data for reporting. - [DATA_EXPOSURE]: The skill is designed to read sensitive financial and configuration data from Databricks system tables (
system.billing.usage,system.compute.clusters). It mitigates risk by enforcing a metastore-admin grant chain requirement and implementing a prerequisite check to verify access before performing detailed analysis. - [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted metadata from the Databricks environment. 1. Ingestion points: Data retrieved from SQL queries and MCP tools (e.g., cluster names and metadata tags). 2. Boundary markers: No explicit prompt boundaries are defined to isolate external data within the final report. 3. Capability inventory: The skill has access to file writing (
Write) and scoped shell execution (Bash). 4. Sanitization: Structural validation is performed through standard JSON parsing libraries. - [DYNAMIC_EXECUTION]: A static Python script (
scripts/rank-and-report.py) included in the skill package is used to process results and generate reports, ensuring consistent and auditable calculations without relying on potentially unreliable LLM-based arithmetic.
Audit Metadata