youtube-summarizer

SUSPICIOUS. The core transcript-and-summary behavior matches the stated purpose, but the skill expands into external messaging and requires installing/running a third-party MCP server from a personal GitHub account. Data flows are mostly proportionate, yet install trust is only moderate and outbound delivery adds risk that should be user-confirmed.

The fragment describes a YouTube transcript and summarization workflow rather than clear malware. Its main security concerns are execution of an unpinned external repository during installation, shell interpolation of user-derived video IDs, and disclosure of full transcripts to Telegram. The Telegram behavior is explicit and functionally related, not hidden, but should be consent-based and destination-validated. Review the referenced repository and ensure strict video-ID validation, safe process argument handling, dependency pinning, and temporary-file cleanup before deployment.