youtube-processor

SUSPICIOUS. The core behavior fits the stated purpose, and the PyPI dependency is broadly legitimate, but the hosted transcript path routes data through an unverified Vercel app instead of an official or clearly publisher-owned endpoint. Scope is otherwise proportionate, with no obvious credential harvesting, so this is medium risk rather than confirmed malware.