youtube-data

SUSPICIOUS: The skill is mostly coherent for third-party YouTube data retrieval and uses same-domain TranscriptAPI endpoints without any installer or binary supply-chain concerns. Risk comes from requiring a non-official intermediary service, having the agent create accounts and handle OTP/auth tokens, and instructing persistent secret storage in local config; this is moderate security exposure rather than confirmed malicious behavior.

No executable code was supplied, but the document is a credential-collection and credential-persistence workflow. It requests API keys and OTPs, forwards authentication data to an external service, and stores the resulting secret persistently. This is consistent with a potential credential-harvesting or unauthorized account-provisioning pattern and should not be followed without independently verifying the service, authorization, and secure secret-management process.