qqmusic

SUSPICIOUS. The core music-search/recommendation functionality aligns with the stated purpose and uses same-org QQ Music domains, so this does not look like confirmed malware. But the skill persists API keys by editing shell profiles and advertises an auto-download/replace updater whose source and integrity are not provided, creating medium trust and secret-handling risk.