finding-youtube-sponsorship-candidates

SUSPICIOUS. The skill’s purpose and credential scope are broadly coherent, and it talks to official Apify endpoints, but its core functionality depends on a community-maintained remote actor that is not readily source-verifiable from the skill alone. This is not confirmed malware, but it carries medium supply-chain and credential-forwarding risk, increased by the query-string token example.