Databricks pack · security review

What it touches

The access surface of one skill — databricks-cost-leak-hunter v2.27.0, one of five skills in the Databricks pack — read off its own allowed-tools frontmatter and the calls its instructions make. Six asset groups, three verbs, and the intersections it never asks for.

Access matrix for the databricks-cost-leak-hunter skill A six-row by three-column grid. Rows are Databricks assets: billing tables, cluster configuration, warehouse configuration, job runs, notebooks and secret scopes, and customer table data. Columns are read, write and delete. Only two cells are populated, both in the read column: a SELECT on the system.billing tables, marked as the deepest access requested, and a read of cluster and pool configuration from system.compute plus five read-only workspace MCP tools. Warehouse configuration and job runs appear as identifier-only references that are never fetched. Notebooks, secret scopes and customer table data are untouched in all three columns, and the entire write and delete columns are empty. ASSET / ACCESS DEFAULT: NOT REQUESTED READ SELECT · GET WRITE CREATE · UPDATE DELETE DROP · REMOVE Billing tables system.billing Billing tables, read — SELECT on system.billing.usage and system.billing.list_prices. Requires a metastore-admin grant chain the customer issues: USE CATALOG on system, USE SCHEMA on system.billing, SELECT on both tables. This is the deepest access requested anywhere in the grid. Source: SKILL.md Prerequisites and Steps 1 to 2. SELECT uc grant chain Billing tables, write — not requested. No write statement appears anywhere in SKILL.md. Billing tables, delete — not requested. No DROP or DELETE statement appears anywhere in SKILL.md. Cluster config system.compute + rest Cluster config, read — SELECT on system.compute.clusters and system.compute.node_timeline, plus five read-only databricks-workspace-mcp tools: clusters_get, clusters_list, clusters_events, instance_pools_list, pipelines_get. Config and event evidence only. Source: SKILL.md allowed-tools and Steps 3 to 6. SELECT + GET uc grant · 5 mcp reads Cluster config, write — not requested. The five workspace MCP tools in allowed-tools are all read-only getters and listers; no create, edit, resize or policy tool is granted. Cluster config, delete — not requested. No delete, terminate or permanent-delete tool appears in allowed-tools. Warehouse config sql warehouse Warehouse config, read — referenced, not read. The operator sets DATABRICKS_WAREHOUSE_ID and the skill passes that id as the statement-execution endpoint. No warehouse API tool appears in allowed-tools and no warehouse setting is fetched. ID ONLY exec endpoint Warehouse config, write — not requested. The skill never creates, edits, starts or resizes a SQL warehouse. Warehouse config, delete — not requested. No warehouse delete path exists in the skill. Job runs jobs api Job runs, read — referenced, not read. A job_id appears in usage_metadata on a billing row, which is how Step 4 spots a scheduled job billed on All-Purpose compute. No Jobs API tool appears in allowed-tools: run history, task definitions, parameters and job output are never fetched. ID ONLY from billing row Job runs, write — not requested. The skill never creates, edits, triggers or reruns a job. Job runs, delete — not requested. No job or run deletion path exists in the skill. Notebooks + secrets workspace files + scopes Notebooks and secret scopes, read — not requested. No workspace, files, notebook or secrets tool appears in allowed-tools. Notebook source, cell output and revision history are never read. SKILL.md states that no secrets are hardcoded and that all auth comes from the environment (DATABRICKS_HOST and DATABRICKS_TOKEN, or databricks auth login) or from the separately authenticated MCP server. Notebooks and secret scopes, write — not requested. The skill never imports, exports or edits a notebook, and never creates a scope or puts a secret. Notebooks and secret scopes, delete — not requested. No workspace or secret-scope deletion path exists in the skill. Table data your uc catalogs Table data, read — not requested. Every query in SKILL.md reads the system catalog only: system.billing.usage, system.billing.list_prices, system.compute.clusters, system.compute.node_timeline. No user catalog, schema, table or row is read. Table data, write — not requested. No INSERT, UPDATE, MERGE or COPY INTO statement appears anywhere in SKILL.md. Table data, delete — not requested. No DROP, DELETE or TRUNCATE statement appears anywhere in SKILL.md. EVERY DATABRICKS CALL IN SKILL.MD IS A READ — SELECT STATEMENTS PLUS FIVE READ-ONLY MCP TOOLS. SCOPE NOTE: THE GRANTED BASH SCOPE IS databricks:* — BROADER THAN THE CALLS THE SKILL MAKES. LEGEND DEEPEST ASK GRANTED READ REFERENCED, NOT READ — NOT REQUESTED

What you are looking at. Each row is an asset a Databricks security reviewer asks about; each column is one of the three verbs. Only two cells are populated, both in the read column — a SELECT on system.billing, accented because it is the deepest access requested anywhere and the one needing a metastore-admin grant chain, and a read of cluster and pool configuration from system.compute plus five read-only workspace MCP tools. Two more cells are dashed rather than empty because the honest answer is narrower than either yes or no: a warehouse id and a job id are handled, but neither object is ever fetched. Everything else is deliberate negative space — no notebook source, no secret scope, no row from any catalog of yours, and not a single entry in the write or delete columns.

Three caveats, stated rather than hidden. First, the grid covers Databricks assets, and the skill's allowed-tools does grant Write and Edit — those act on your local filesystem, not your workspace: Step 7 writes the ranked report and the per-category leak-*.json into a working directory and edits the report only if you ask for the headline spend rescaled. Nothing is written back to Databricks. Second, the package's setup reference carries the only mutating commands anywhere in the skill — the GRANT chain and the api put that enables the system schemas. Those are metastore-admin prerequisites you run: when the grant probe fails, Step 1 reports the missing chain and stops rather than issuing it. Third, the granted Bash scope is databricks:*, broader than the calls the skill actually makes and broad enough to permit those admin commands, so narrow it in your own settings if your review requires the permission and the behaviour to match exactly.

← Back to the cost-leak hunter

Read — SKILL.md v2.27.0 · allowed-tools + Steps 1–7 · references/ + scripts/ scanned, not line-audited · 2026-08-13