databricks-cost-leak-hunter

SUSPICIOUS. The stated purpose and main Databricks API usage are coherent and mostly benign, but the skill’s reliance on a custom databricks-workspace-mcp introduces unverifiable third-party trust and possible credential forwarding beyond what is proven here. No direct exfiltration, malicious pre-execution, or clear concealment is present, so this is not confirmed malware.