yandex-direct

SUSPICIOUS. The skill’s purpose and Yandex-specific credentials are coherent, and its documented data flows point to official Yandex OAuth/API endpoints. The main risk is install trust: it relies on an unverified npx package that receives a live OAuth token and can perform real advertising mutations, making the overall footprint high-risk despite otherwise plausible purpose alignment.