youtube-api

SUSPICIOUS: the skill is internally coherent for YouTube data access, but it routes all content and credentials through a third-party service and has the agent handle account signup, OTP verification, temp-file token handling, and persistent secret storage. No malware-like installer, hidden execution, or unrelated credential harvesting is present, but the trust and secret-handling footprint is broader than a simple read-only data skill.

No executable code was supplied, but the document is a credential-collection and credential-persistence workflow. It requests API keys and OTPs, forwards authentication data to an external service, and stores the resulting secret persistently. This is consistent with a potential credential-harvesting or unauthorized account-provisioning pattern and should not be followed without independently verifying the service, authorization, and secure secret-management process.