mmk-youtube-transcript

SUSPICIOUS. The stated purpose is narrow and coherent for a YouTube transcript skill, and this excerpt shows no credential theft or exfiltration behavior. However, it depends on an `mmk` CLI whose official provenance and install path were not verifiable from public evidence, and key auth/endpoint behavior is hidden in an unseen shared skill. Treat as high security risk from unverifiable dependency trust, but not confirmed malware from this excerpt alone.