Openclaw Thumbnail Forge

• Analyzed: May 9, 2026, 9:31 AM
• Findings: 1
• Version: 0.2.0
• Hash: 2a2fd13d8cae82d5a0be0dd3589d384af7414b0411c47244104479b11cc86cd9
• Source: palm
• External report: View on VirusTotal

Findings (1)

The openclaw-thumbnail-forge skill is a local utility for generating and scoring video thumbnails using ffmpeg and the Pillow library. The code implements several safety measures, including strict path validation via regex (SAFE_PATH_RE) and the use of subprocess.run with argument lists instead of shell=True to prevent command injection. No network activity, data exfiltration, or persistence mechanisms were found across the scripts (compose_thumbnail.py, pick_frames.py, score_thumbnail.py, etc.), and the SKILL.md instructions are consistent with the stated purpose.