youtube-ingest

SUSPICIOUS: the core YouTube-to-Obsidian workflow is plausible, but the skill’s footprint is broadened by an opaque transitive dependency (`social-to-imgur`) and automatic local persistence via git. Main concerns are unverifiable third-party skill trust, unclear credential/data routing for the Imgur upload step, and unpinned runtime package execution rather than direct malicious behavior.