youtube-automation

SUSPICIOUS: The skill’s YouTube capabilities fit its stated purpose, but its setup points to a discontinued Rube MCP endpoint and relies on third-party token custody and action routing through Composio rather than direct Google APIs. This is not confirmed malware, but it carries medium risk due to stale install trust, expanded data-flow trust boundaries, and autonomous public-action capability.