youtube

SUSPICIOUS. The skill's YouTube and transcript capabilities largely match its stated purpose, and the PyPI dependency is a normal open-source package. The main concern is data-flow integrity: official YouTube operations are routed through a Rebyte proxy with bearer-token forwarding, and the exact proxy endpoint was not publicly verified. This looks more like a managed platform integration than outright malware, but the intermediary architecture and unofficial transcript access make it medium risk rather than benign.