youtube-search

SUSPICIOUS. The stated purpose is coherent for a search skill, and there is no installer or obvious malware pattern. However, the core trust path is unverifiable because the actual script is missing, the remote endpoint is not named in the skill, and the documented credential/provider mismatch (FREVANA_TOKEN vs publicly found YouTube Search docs) weakens data-flow integrity. Main risk is forwarding a bearer token to an unverified backend for a simple search task.