youtube-thumbnail-design

SUSPICIOUS: the core purpose is coherent, and data appears to flow to official inference.sh services, but the skill mixes design guidance with external CLI installation, broad Bash permission, inconsistent install naming, and transitive skill installs. This looks more like a legitimate but over-trusting integration than confirmed malware.