v1.0.0

video-thumbnail

BenignClawScan verdict for this skill. Analyzed May 1, 2026, 8:14 AM.

Analysis

This appears to be a simple thumbnail-generation instruction skill, but users should notice that it references a missing script and an undeclared API key.

GuidanceThis skill is not showing malicious behavior in the provided artifacts, but it appears incomplete. Verify the missing script and the purpose of THUMBNAIL_API_KEY before installing or running anything.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Agentic Supply Chain Vulnerabilities

SeverityLowConfidenceHighStatusNote

SKILL.md

python3 scripts/video_thumbnail.py --input <input> --output <output>

The skill tells the user to run a helper script, but the provided manifest contains only SKILL.md and no scripts directory or install spec.

User impactThe skill may be incomplete or require code from outside the reviewed artifacts.

RecommendationBefore using it, confirm where the referenced script comes from and review that code separately.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityLowConfidenceMediumStatusNote

SKILL.md

export THUMBNAIL_API_KEY="your-api-key"

The skill asks for an API key, but the registry metadata declares no required environment variables or primary credential.

User impactA user may be asked to provide a credential for an unspecified thumbnail service.

RecommendationOnly provide an API key if you know which service it belongs to, what permissions it has, and why it is needed.