youtube-thumbnail-design

SUSPICIOUS. The skill’s stated purpose and capabilities mostly align: it teaches thumbnail design and uses inference.sh for image generation. The main concerns are transitive skill installation (`npx skills add ...`) and reliance on an external CLI/auth flow, which broaden trust beyond this document. Data flows appear proportionate and same-vendor, so this is not strongly malicious, but it carries medium supply-chain and trust-chain risk.