film-breakdown

This is a Markdown-to-HTML report generator, not apparent malware. It has a significant security risk when processing untrusted Markdown: raw HTML and unvalidated link targets can produce stored XSS in the generated report, and image path resolution can read files outside the intended directories and embed them in the output. External image references can also contact their hosts when a report is viewed. Severity is high for untrusted input; no specific external domain, credential, or environment variable is hardcoded.