video-thumbnail

SUSPICIOUS: The core thumbnail-generation workflow is coherent and mostly proportionate, but the skill sends user assets to external APIs and routes research through a third-party ScrapeCreators service rather than an official YouTube API. The biggest risks are third-party data exposure, arbitrary web image downloads, and moderate indirect prompt-injection surface from external content, not confirmed malware.