ia-presenter

This is a Markdown-to-iA-Presenter packaging utility. It contains a path traversal risk: untrusted /assets/ names can escape the output assets directory and cause asset copies to overwrite locations outside it. Restrict asset names to safe relative paths and verify resolved destinations remain within the assets directory.

The script has a potentially destructive path traversal issue: an untrusted template.json Name can escape the intended Themes directory and, with --force, cause an out-of-scope path to be removed before copying. No clear malware behavior is evident. Use only trusted theme files until the Name is validated as a safe basename and the resolved destination is constrained to the Themes directory.