Only way I'd described using an API as meddling is if it wasn't a publicly documented API (yet was still unauthenticated) or if a bot stole a token from a repo or both.