[P1] Audit: YouTube Thumbnail Grabber needs stronger external-request and rights confirmation UX

[baixiangcpp]

Imported from the byteflow.tools deep audit on 2026-06-22.

Problem: YouTube Thumbnail Grabber is correctly marked as an external-request tool, but the preview/download workflow should make external network access and media rights even more explicit at the moment of action.

Affected URL:

• https://byteflow.tools/en/youtube-thumbnail-grabber

Reproduction steps:

1. Open YouTube Thumbnail Grabber.
2. Click Sample.
3. Review the trust panel and compliance guidance.
4. Click Preview and observe whether the UI confirms that an external thumbnail URL may be requested.
5. Try invalid URLs and offline mode.

Expected behavior: users should see clear action-level confirmation before external requests and before downloading/reusing thumbnails.

Actual behavior: the page has good static disclosure, but the action buttons could better reinforce external-request and rights boundaries.

Impact: users may not notice when network access begins or may reuse media without checking rights.

Proposed fix:

• Add inline message near Preview: “This may request a public thumbnail URL from i.ytimg.com.”
• Add a one-time confirmation for first external preview per session.
• Add stronger rights notice before Download.
• Improve invalid URL and offline states.
• Show selected quality, candidate URL, and request status clearly.

Acceptance criteria:

• Preview clearly indicates external request before it runs.
• Download requires selected candidate and shows rights guidance.
• Invalid, unreachable, and offline states are understandable.
• Network requests occur only after explicit user action.
• Tool trust panel and action-level copy are consistent.

[baixiangcpp]

Closed as completed by the canonical BF audit backlog work. This older non-BF audit issue duplicates work now merged through PRs #209-#219, with the BF issues closed and guard/test coverage in place. The remaining non-duplicate follow-up is #7, which stays open because the upstream Next/PostCSS advisory is not fixed yet.