illustrated-explainer

This code generates and renders video from a brief, but its voice command has a command-injection vulnerability: the brief-controlled vo.audio path is interpolated unquoted into an os.system() ffmpeg command. Brief-controlled file paths can also escape the project directory when an untrusted brief is used. No explicit data theft or other malware behavior is visible; severity is moderate to high when processing untrusted briefs, and the external behavior of imported helpers is not assessable from this file.