video-thumbnail

Pass

Audited by Gen Agent Trust Hub on Jul 21, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses Python scripts to perform various tasks such as searching for YouTube thumbnails, downloading images via curl, and processing them with the Pillow library. These are routine operations for an image-generation workflow.
  • [EXTERNAL_DOWNLOADS]: The skill downloads example thumbnails from YouTube and logos/icons from the web for composition. It implements a strong security check using the file command and internal Python byte-header checks to ensure downloaded files are actual images and not malicious HTML/script files returned by blocked requests.
  • [CREDENTIALS_UNSAFE]: The skill correctly handles sensitive information by instructing the user to store API keys (GEMINI_API_KEY, SCRAPECREATORS_API_KEY) in a .env file, which is a standard and safe practice for secret management. It also explicitly includes a .gitignore note for user headshots.
  • [SAFE]: The code implements image resizing and normalization to ensure stable performance and avoid memory issues during generation. The process follows a logical flow of user-approved steps before executing potentially expensive API calls.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 21, 2026, 08:07 PM