youtube-research-automation

SUSPICIOUS due to transitive skill installation and reliance on a third-party hosted API/MCP service, but not malicious. The skill’s capabilities mostly match its stated YouTube research purpose, data flows are openly disclosed to TranscriptAPI, and the main concerns are mutable external installs, remote service trust, and credential forwarding to that service rather than hidden exfiltration or covert behavior.