h5p-type-scaffold

This is a project scaffolding script, but its unescaped interpolation of command-line metadata into Python source creates a local code-execution risk for crafted arguments. User-controlled output paths also allow writes outside the intended directory. The fragment shows no evidence of intentional malware, but should be fixed before use with untrusted inputs.

The script has a concrete code-injection risk: the caller-controlled library directory path is interpolated into Python source passed to python3 -c. The machineName metadata is also used in paths without validation, creating path-manipulation risk. No evidence of network exfiltration or intentional malware behavior appears in the fragment. Pass the path as a separate Python argument and validate machineName as a safe basename.