youdao-note

SUSPICIOUS. The skill's capabilities match a YoudaoNote integration, but it relies on an unpinned remote installer and then gives that CLI the user's API key. Domain ownership appears consistent with NetEase/Youdao, so this is not confirmed malicious, but the unverifiable install path and credential forwarding make the security risk high.