bilibili-transcript

SUSPICIOUS. The skill’s purpose and requested access are mostly coherent for transcript extraction, and the PyPI Whisper install is standard. However, the unseen local script prevents verification of actual credential/data handling, and the stated model fetch from third-party hf-mirror weakens install/data-flow trust. This looks more like a plausible but medium-risk workflow skill than malware.