mmk-youtube-metadata

The stated purpose is narrow and the visible behavior is consistent with fetching YouTube metadata, but the skill relies on an unverified `mmk` executable and hides auth/network details in an unseen shared skill. That makes it suspicious from an install-trust perspective rather than clearly malicious.