thumbnail

SUSPICIOUS: the skill is internally coherent for thumbnail generation, but it sends personal photos, prompts, and generated assets through a third-party aggregator (KIE.ai) and fetches untrusted remote thumbnails. No clear malware behavior or deceptive exfiltration is shown, yet the privacy and third-party processing footprint is material enough to rate as suspicious rather than benign.

No clear evidence of intentional malware, backdoor behavior, or obfuscation in this fragment. However, the script performs high-impact actions: it exfiltrates user-specified local files to a remote service and then downloads remote-provided URLs and writes the raw bytes to disk without allowlisting/validation or download size/content checks. Additionally, relative path handling for --refs/--competitor and the output directory base (--output) lacks normalization/containment safeguards, which can enable unintended file access/upload and unsafe write targets if the caller supplies crafted paths. This is best treated as a network-and-file automation tool requiring strict input validation and URL allowlisting under a conservative threat model.