douyin-hotlist-overall

SUSPICIOUS. The skill’s behavior is mostly coherent with its stated purpose, but it depends on a third-party hosted backend, forwards an API key to that service, and lacks strong same-org provenance between the GitHub publisher and ai-skills.ai. This is not clearly malicious, but the trust chain and credential forwarding warrant caution.