video-transcripts

SUSPICIOUS: The skill is mostly coherent with its stated purpose, and the data flows go to expected first-party services. However, it extracts local credentials/cookies (`gh auth token`, Linear desktop cookies, ~/.bash_profile) and forwards protected content to external APIs, which is more invasive than a basic transcript helper and creates medium security risk even without clear malicious intent.

The script has a specific credential-leak risk: URL substring matching can cause Linear cookies or GitHub tokens to be sent to an attacker-controlled host. It also uploads the selected video to Gemini as part of its intended purpose. Validate exact URL hostnames before attaching credentials; otherwise, no clear malware behavior is evident.