cost-export

SUSPICIOUS. The skill's main capability—exporting cost telemetry to dashboards—is coherent with its purpose, and there is no evident malicious installer or hidden credential theft. However, it is designed to transmit internal tracking data and optional auth headers to arbitrary webhook endpoints, which is a real exfiltration surface and broader than a purely local metrics exporter.