Youtube Thumbnail Design

YouTube thumbnail design with specific dimensions, contrast rules, and mobile preview optimization. Covers safe zones, text placement, face expression psycho...

This skill appears to do what it says (generate thumbnail images and give design guidance) but take these precautions before installing or running it: - Avoid running the recommended curl | sh pipeline. That pattern executes remote code immediately and bypasses verification. Instead, manually download the CLI binary or follow the manual install steps and verify the SHA-256 checksums on the project's dist.inference.sh site before running any installer. - Expect the infsh CLI to require login/auth tokens. If you must authenticate, prefer short-lived credentials, inspect where tokens are stored, or run the CLI in an isolated environment (container or VM) so stored tokens cannot be reused by other tools. - Review the remote domain (inference.sh / dist.inference.sh) and, if possible, inspect the CLI source or package artifacts before running. If you cannot verify provenance, run the workflow in a sandbox. - Because part of the SKILL.md was truncated, consider asking the publisher for the full instructions and confirm there are no additional steps that read local files or post content to unexpected endpoints. Given the insecure default install guidance and potential for the CLI to obtain credentials, proceed with caution — the skill is coherent but the install/runtime recommendations are risky unless you verify them manually.

Type: OpenClaw Skill Name: youtube-thumbnail-design Version: 0.1.5 The skill utilizes a `curl -fsSL ... | sh` pattern in `SKILL.md` for installing the `inference.sh` CLI, which introduces a supply chain vulnerability by executing a remote script directly. Furthermore, it grants broad `allowed-tools: Bash(infsh *)` permissions, creating a potential prompt injection surface if the AI agent is manipulated to execute unintended `infsh` commands. While these present significant security risks, there is no direct evidence of intentional malicious behavior such as data exfiltration, persistence, or backdoors within the skill's provided code or instructions.