YouTube Distiller

This skill mostly does what it claims, but there are several red flags you should address before installing or running it: - Do not trust the embedded API key in the README/dev docs. Treat it as leaked; if you or your org ever used it, rotate/ revoke it immediately. The presence of a literal key in the repo is a security problem. - The skill needs an API key (MINIMAX_API_KEY) though the registry metadata does not declare it — expect to set that env var yourself. Only provide a key you control and are willing to use with this third-party service. - The script expects yt-dlp at a specific Windows path and uses many hardcoded C:\butler_sumo paths. If you run this on a different OS or without those directories the script could fail or create files in unexpected locations. Review and, if needed, change the paths before running. - Review the code (youtube_distiller.py) locally to confirm it only sends subtitle text to the stated API and does not exfiltrate other data. Consider running it in an isolated environment (VM/container) and monitoring outgoing network requests on first run. - If you only want local summaries, consider removing or disabling the API calls and using an offline summarizer (or supply your own provider) so you don't send data to a third-party service. Given these inconsistencies (undeclared env var and binaries, hardcoded file paths, and a leaked-looking API key), treat this skill as suspicious until the repository owner clarifies and removes the exposed credential and documents required dependencies and filesystem behavior.