desktop-packaging-tauri

No explicit malware or obfuscation is evident in the provided fragment. However, the command creates a meaningful security attack surface: untrusted `input` is passed directly to an external ffmpeg sidecar as the `-i` argument, and the resulting stdout/stderr (often path- and environment-revealing) is returned to the caller. Additionally, a fixed `output.mp4` name can cause overwrite/collision issues. Treat this as a security-relevant component requiring input validation and execution sandboxing/permission tightening (e.g., capability restrictions, allowlisted input sources, isolated output paths).