youtube

SUSPICIOUS. The skill’s capabilities match its stated YouTube purpose, but it proxies all API calls and managed OAuth through Maton-controlled domains instead of Google’s official endpoints. That third-party credential and data routing is disproportionate for a straightforward YouTube API skill and weakens data-flow integrity, though there is no evidence of malware, hidden execution, or an unverifiable binary.