recreate-thumbnails

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). This skill explicitly automates uploading target thumbnails and reference face photos to a third‑party image-generation API to produce "100% exact duplicate except face" swaps—functionally enabling highly convincing impersonation/non-consensual deepfakes and exfiltrating biometric images to an external service; there are no signs of hidden backdoors, remote code execution, credential-stealing logic, or obfuscated payloads in the code itself.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill explicitly downloads and ingests images from public sources—e.g., get_youtube_thumbnail pulls thumbnails from https://img.youtube.com/vi/{video_id}/{quality}.jpg and download_image fetches arbitrary HTTP/HTTPS URLs—and those untrusted images are analyzed and passed into the generation model, so third‑party content can directly influence model behavior and outputs.